VirtualTam's bookmarks

1. SHAttered 2017-02-24

   tags: attack, checksum, collision, cryptography/hash, security, sha1, source-code-management/git

   [ permalink ]

   • https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
   • https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/
   • https://news.ycombinator.com/item?id=13719368
   • https://github.com/peff/git/commits/jk/sha1dc
   • https://plus.google.com/+LinusTorvalds/posts/7tp2gYWQugL
2. How would git handle a SHA-1 collision on a blob? - Stack Overflow 2015-02-14

   tags: algorithm, code, collision, commit, cryptography/hash, patch, review, security, sha1, source-code-management/gerrit, source-code-management/git

   [ permalink ]

   • https://en.wikipedia.org/wiki/SHA-1
   • http://stackoverflow.com/questions/1867191/probability-of-sha1-collisions
   • http://en.wikipedia.org/wiki/Birthday_problem

   Some thoughts we had while toying with Gerrit, which artificially tracks different commits to group them as "patch sets", by using a Change-Id SHA-1 in the commit message:

   • https://gerrit-review.googlesource.com/Documentation/cmd-hook-commit-msg.html
   • https://gerrit.googlesource.com/git-repo/+/master/hooks/commit-msg
3. gitbrute: bruteforce a Git commit SHA-1 2015-02-14

   tags: collision, commit, cryptography/hash, sha1, source-code-management/git

   [ permalink ]

   Applied example: https://github.com/bradfitz/deadbeef