Git 2.13 - Hackdot

Re:Git 2.13 by ReligiousFlames on Wednesday May 10, 2017 @01:34AM (#14306119)

On git moving away from SHA1: it's about time.

- There shouldn't be too many nor too few hash algos. Too many: paradox of choice, user confusion and interop overhead. Too few: security monoculture risks being broken by well-funded state actors

- Sane, future-ready default: SHA3-512

Also, git GPG signing should change to signing content, in addition to or instead of, hashes.

[ Parent | on HN ]

Re:Git 2.13 by adrianN on Wednesday May 10, 2017 @02:16AM (#14306253)

Isn't signing a hash the standard procedure for signatures?

[ Parent | on HN ]

Re:Git 2.13 by dozzie on Wednesday May 10, 2017 @08:57AM (#14307775)

The thing is, you are signing hash of a hash of data instead of simply hash of data.

[ Parent | on HN ]

Re:Git 2.13 by lgas on Wednesday May 10, 2017 @02:30AM (#14306293)

What would be the benefit of signing content instead of hashes?

[ Parent | on HN ]

Re:Git 2.13 by rurban on Wednesday May 10, 2017 @10:49AM (#14308619)

The benefit would be to trust the content, and not the hash of the content. Esp. with SHA1 being the only hash so far.

[ Parent | on HN ]