@matheusbsbs / matheus-bagliano / commits / 5988eb631a

doc hash-function-transition: clarify what SHAttered means

Attempt to clarify what the SHAttered attack means in practice for Git. The previous version of the text made no mention whatsoever of Git already having a mitigation for this specific attack, which the SHAttered researchers claim will detect cryptanalytic collision attacks. I may have gotten some of the nuances wrong, but as far as I know this new text accurately summarizes the current situation with SHA-1 in git. I.e. git doesn't really use SHA-1 anymore, it uses Hardened-SHA-1 (they just so happen to produce the same outputs 99.99999999999...% of the time). Thus the previous text was incorrect in asserting that: [...]As a result [of SHAttered], SHA-1 cannot be considered cryptographically secure any more[...] That's not the case. We have a mitigation against SHAttered, *however* we consider it prudent to move to work towards a NewHash should future vulnerabilities in either SHA-1 or Hardened-SHA-1 emerge. Signed-off-by: Ævar Arnfjörð Bjarmason <avarab@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Ævar Arnfjörð Bjarmason committed Mar 26, 2018 at 18:27 UTC 5988eb631a3a3a42f82c1442fae79001ad2b90e7
1 file changed +24 -5
Documentation/technical/hash-function-transition.txt
+24 -5
@@ -28,11 +28,30 @@ advantages:
28 address stored content.
29
30 Over time some flaws in SHA-1 have been discovered by security
31 -researchers. https://shattered.io demonstrated a practical SHA-1 hash
32 -collision. As a result, SHA-1 cannot be considered cryptographically
33 -secure any more. This impacts the communication of hash values because
34 -we cannot trust that a given hash value represents the known good
35 -version of content that the speaker intended.
31 +researchers. On 23 February 2017 the SHAttered attack
32 +(https://shattered.io) demonstrated a practical SHA-1 hash collision.
33 +
34 +Git v2.13.0 and later subsequently moved to a hardened SHA-1
35 +implementation by default, which isn't vulnerable to the SHAttered
36 +attack.
37 +
38 +Thus Git has in effect already migrated to a new hash that isn't SHA-1
39 +and doesn't share its vulnerabilities, its new hash function just
40 +happens to produce exactly the same output for all known inputs,
41 +except two PDFs published by the SHAttered researchers, and the new
42 +implementation (written by those researchers) claims to detect future
43 +cryptanalytic collision attacks.
44 +
45 +Regardless, it's considered prudent to move past any variant of SHA-1
46 +to a new hash. There's no guarantee that future attacks on SHA-1 won't
47 +be published in the future, and those attacks may not have viable
48 +mitigations.
49 +
50 +If SHA-1 and its variants were to be truly broken, Git's hash function
51 +could not be considered cryptographically secure any more. This would
52 +impact the communication of hash values because we could not trust
53 +that a given hash value represented the known good version of content
54 +that the speaker intended.
55
56 SHA-1 still possesses the other properties such as fast object lookup
57 and safe error checking, but other hash functions are equally suitable