{"thread":{"id":"42646","subject":"Re: Migrating away from SHA-1?","startedAt":"2016-06-18T02:31:25Z","lastAt":"2016-06-24T18:17:16Z","messageCount":3,"participants":["Leo Gaspard","Eric Wong","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"289545","messageId":"02b42587-3643-1c2e-c249-313ec96bcdca@gaspard.io","threadId":"42646","inReplyTo":null,"subject":"Re: Migrating away from SHA-1?","fromName":"Leo Gaspard","fromEmail":"leo@gaspard.io","sentAt":"2016-06-18T02:10:27Z","receivedAt":"2016-06-18T02:31:25Z","isPatch":false,"sender":{"key":"leo@gaspard.io","avatar":null},"body":"First, sorry for not having this message threaded: I'm not subscribed to\nthe list and haven't found a way to get a Message-Id from gmane.\n\nI just wanted to ask, as an end-user highly relying on commit\nsignatures, a few questions as to the migration away from SHA-1.\n\nSHA-1 already suffers from a freestart collision attack. Based on what I\nunderstand of the object model of git, a chosen-prefix collision attack\n(perhaps somewhat improved) is enough to make reviewers accept a patch,\nsign it, and then swap the innocuous-looking patch for an evil-doing one\n-- which *will be signed*.\n\nAs for the issue about code checking being an easier entrypoint\n(Theodore Ts'o, 2016-04-14 22:40:51 GMT), in a use case of mine there is\na repo with my dotfiles on an untrusted server. Yet I download them and\nam able to execute them without fear because each commit is PGP-signed\nwith my key. The point being that code checking is not even a possible\nentrypoint in some cases, so SHA-1 seems to be(come) the weakest link.\n\nSo, I don't think it is possible to disagree with Jeff King when he\nwrote his 2016-04-12 23:15:19 GMT email.\n\nPeter Anvin (2016-04-14 17:28:50 GMT) gets a point in that there is no\nneed to hurry (chosen-prefix collisions may be still quite a long way,\neven though there is no guesswork in these matters), and quality is\nimportant. Yet Jeff King's proposal (2016-04-12 23:42:52 GMT), amended\nby Junio Hamano (2016-04-13 01:03:02 GMT) and himself (2016-04-13\n01:36:32 GMT) seem to have met no opposition.\n\nSo, my questions to the git team:\n * Is there a consensus, that git should migrate away from SHA-1 before\nit gets a collision attack, because it would mean chosen-prefix\ncollision isn't far away and people wouldn't have the time to upgrade?\n * Is there a consensus, that Peter Anvin's amended transition plan is\nthe way to go?\n * If the two conditions above are fulfilled, has work started on it\nyet? (I guess as Brian Carlson had started his work 9 weeks ago and he\nwas speaking about working on it on the week-end he should have finished\nit now, so excluding this)\n * If the two first conditions are fulfilled, is there anything I could\ndo to help this transition? (including helping Brian if his work hasn't\nactually ended yet)\n\nSorry for bringing up again a subject that seems to be quite recurrent,\nand for this long block of text,\nLeo Gaspard\n\n"},{"id":"289546","messageId":"20160618033019.GB11307@dcvr.yhbt.net","threadId":"42646","inReplyTo":"02b42587-3643-1c2e-c249-313ec96bcdca@gaspard.io","subject":"Re: Migrating away from SHA-1?","fromName":"Eric Wong","fromEmail":"e@80x24.org","sentAt":"2016-06-18T03:30:19Z","receivedAt":"2016-06-18T03:30:25Z","isPatch":false,"sender":{"key":"e@80x24.org","avatar":null},"body":"Leo Gaspard <leo@gaspard.io> wrote:\n> First, sorry for not having this message threaded: I'm not subscribed to\n> the list and haven't found a way to get a Message-Id from gmane.\n\nAppending \"/raw\" to the gmane URL will get you the raw message\nwith full headers:\n\n  article.gmane.org/gmane.comp.version-control.git/$NUMBER/raw\n\nyou can also use that article $NUMBER via NNTP on news.gmane.org\n\n> So, my questions to the git team:\n\nIt is customary to Cc: all relevant parties involved with that\nthread since they may not all be subscribed, either.\n\n>  * Is there a consensus, that git should migrate away from SHA-1 before\n> it gets a collision attack, because it would mean chosen-prefix\n> collision isn't far away and people wouldn't have the time to upgrade?\n>  * Is there a consensus, that Peter Anvin's amended transition plan is\n> the way to go?\n>  * If the two conditions above are fulfilled, has work started on it\n> yet? (I guess as Brian Carlson had started his work 9 weeks ago and he\n> was speaking about working on it on the week-end he should have finished\n> it now, so excluding this)\n\nAFAIK, brian is still working on it.  Last series on the matter\nbegins here:\nhttp://mid.gmane.org/20160607005716.69222-2-sandals@crustytoothpaste.net\nI'm just on the sidelines observing :)\n\n>  * If the two first conditions are fulfilled, is there anything I could\n> do to help this transition? (including helping Brian if his work hasn't\n> actually ended yet)\n"},{"id":"290037","messageId":"20160624181705.GA7035@vauxhall.crustytoothpaste.net","threadId":"42646","inReplyTo":"02b42587-3643-1c2e-c249-313ec96bcdca@gaspard.io","subject":"Re: Migrating away from SHA-1?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2016-06-24T18:17:06Z","receivedAt":"2016-06-24T18:17:16Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On Sat, Jun 18, 2016 at 03:10:27AM +0100, Leo Gaspard wrote:\n> First, sorry for not having this message threaded: I'm not subscribed to\n> the list and haven't found a way to get a Message-Id from gmane.\n\nSorry it's taken so long to get back to this.  I've been at a\nconference.\n\n> So, my questions to the git team:\n>  * Is there a consensus, that git should migrate away from SHA-1 before\n> it gets a collision attack, because it would mean chosen-prefix\n> collision isn't far away and people wouldn't have the time to upgrade?\n\nI plan on adding support for a new hash as soon as that's possible, but\nI don't have a firm timeline.  This is a volunteer effort in my own\nlimited free time.\n\n>  * Is there a consensus, that Peter Anvin's amended transition plan is\n> the way to go?\n\nI'm not planning on changing algorithms in the middle of a repository.\nThis will only be available on new or imported repositories.\n\nMy current thinking on proposed algorithms is SHA3-256 or BLAKE2b-256.\nThe cryptanalysis on SHA-256 indicates that it may not be a great\nlong-term choice, and I expect people won't want to change algorithms\nfrequently.\n\nIf time becomes extremely urgent, we can always add support for a\n160-bit hash first (e.g. BLAKE2b-160) and then finish the object_id\ntransition later as it becomes convenient.  I'd like to avoid that,\nthough.\n\n>  * If the two conditions above are fulfilled, has work started on it\n> yet? (I guess as Brian Carlson had started his work 9 weeks ago and he\n> was speaking about working on it on the week-end he should have finished\n> it now, so excluding this)\n\nIt takes a long time to get a patch series through.  I'm rather busy and\ndon't always have time to rebase and address issues during the week.\n\n>  * If the two first conditions are fulfilled, is there anything I could\n> do to help this transition? (including helping Brian if his work hasn't\n> actually ended yet)\n\nYou're welcome to send patches if you like.  I try to avoid areas I know\nare under heavy development, like the refs code.\n-- \nbrian m. carlson / brian with sandals: Houston, Texas, US\n+1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only\nOpenPGP: https://keybase.io/bk2204\n"}]}