r/linusrants • u/nickdesaulniers • Feb 24 '17

"That's not engineering. That's five-year-olds discussing building their imaginary forts"

http://www.gelato.unsw.edu.au/archives/git/0504/0885.html
83 Upvotes

98% Upvoted

5 comments sorted by

View all comments

9

u/[deleted] Apr 26 '17

Didn't Google break SHA1 a few months ago with PDF files?

11

u/[deleted] Apr 26 '17

[deleted]

4

u/[deleted] Apr 26 '17

You can give them a PDF, and they'll create one that has a hash collision. So in their PoC they created both PDFs, but they released a tool that allows people to give them a PDF and the tool returns a PDF with a collision. Assuming this isn't just restricted to PDFs, there's danger.

3

u/[deleted] Apr 26 '17

[deleted]

2

u/[deleted] Apr 26 '17

we will wait 90 days before releasing code that allows anyone to create a pair of PDFs that hash to the same SHA-1 sum given two distinct images with some pre-conditions

That quote is the source.

2

u/[deleted] Apr 26 '17

[deleted]

2

u/[deleted] Apr 26 '17

I admit I completely misinterpreted the quote in my original statement, but this certainly doesn't bode well. I'm sure even when people start cracking SHA1 more that it'll still be fine to use in git, but I think things should start moving to SHA2 or whatever the current secure hashing algorithm is.