{"thread":{"id":"48156","subject":"[PATCH 0/2] doc hash-function-transition: minor & major clarifications","startedAt":"2018-03-26T18:27:30Z","lastAt":"2018-03-26T19:03:31Z","messageCount":5,"participants":["Ævar Arnfjörð Bjarmason","Stefan Beller","Eric Sunshine"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"343043","messageId":"20180326182708.26551-1-avarab@gmail.com","threadId":"48156","inReplyTo":null,"subject":"[PATCH 0/2] doc hash-function-transition: minor & major clarifications","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2018-03-26T18:27:06Z","receivedAt":"2018-03-26T18:27:30Z","isPatch":true,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"Having read through the hash-function-transition.txt again, a couple\nof things jumped out at me:\n\nÆvar Arnfjörð Bjarmason (2):\n doc hash-function-transition: clarify how older gits die on NewHash\n\nWe weren't accurately describing how \"git status\" would die on NewHash\nrepos on new versions.\n\n doc hash-function-transition: clarify what SHAttered means\n\nI don't think we had a good summary of how SHA-1 vulnerabilities\noverlap with concerns Git has, now that we've moved to the hardened\nSHA-1.\n\nI may very well have gotten this new summary subtly wrong though. So\nplease review.\n\n .../technical/hash-function-transition.txt | 40 +++++++++++++++----\n 1 file changed, 32 insertions(+), 8 deletions(-)\n\n-- \n2.16.2.804.g6dcf76e118\n\n"},{"id":"343044","messageId":"20180326182708.26551-2-avarab@gmail.com","threadId":"48156","inReplyTo":"20180326182708.26551-1-avarab@gmail.com","subject":"[PATCH 1/2] doc hash-function-transition: clarify how older gits die on NewHash","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2018-03-26T18:27:07Z","receivedAt":"2018-03-26T18:27:32Z","isPatch":true,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"Change the \"Repository format extension\" to accurately describe what\nhappens with different versions of Git when they encounter NewHash\nrepositories, instead of only saying what happens with versions v2.7.0\nand later.\n\nSee ab9cb76f66 (\"Repository format version check.\", 2005-11-25) and\n00a09d57eb (\"introduce \"extensions\" form of\ncore.repositoryformatversion\", 2015-06-23) for the relevant changes to\nthe setup code where these variables are checked.\n\nSigned-off-by: Ævar Arnfjörð Bjarmason \n---\n Documentation/technical/hash-function-transition.txt | 11 ++++++++---\n 1 file changed, 8 insertions(+), 3 deletions(-)\n\ndiff --git a/Documentation/technical/hash-function-transition.txt b/Documentation/technical/hash-function-transition.txt\nindex 417ba491d0..34396f13ec 100644\n--- a/Documentation/technical/hash-function-transition.txt\n+++ b/Documentation/technical/hash-function-transition.txt\n@@ -116,10 +116,15 @@ Documentation/technical/repository-version.txt) with extensions\n \t\tobjectFormat = newhash\n \t\tcompatObjectFormat = sha1\n \n-Specifying a repository format extension ensures that versions of Git\n-not aware of NewHash do not try to operate on these repositories,\n-instead producing an error message:\n+The combination of setting `core.repositoryFormatVersion=1` and\n+populating `extensions.*` ensures that all versions of Git later than\n+`v0.99.9l` will die instead of trying to operate on the NewHash\n+repository, instead producing an error message.\n \n+\t# Between v0.99.9l and v2.7.0\n+\t$ git status\n+\tfatal: Expected git repo version <= 0, found 1\n+\t# After v2.7.0\n \t$ git status\n \tfatal: unknown repository extensions found:\n \t\tobjectformat\n-- \n2.16.2.804.g6dcf76e118\n\n"},{"id":"343045","messageId":"20180326182708.26551-3-avarab@gmail.com","threadId":"48156","inReplyTo":"20180326182708.26551-1-avarab@gmail.com","subject":"[PATCH 2/2] doc hash-function-transition: clarify what SHAttered means","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2018-03-26T18:27:08Z","receivedAt":"2018-03-26T18:27:36Z","isPatch":true,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"Attempt to clarify what the SHAttered attack means in practice for\nGit. The previous version of the text made no mention whatsoever of\nGit already having a mitigation for this specific attack, which the\nSHAttered researchers claim will detect cryptanalytic collision\nattacks.\n\nI may have gotten some of the nuances wrong, but as far as I know this\nnew text accurately summarizes the current situation with SHA-1 in\ngit. I.e. git doesn't really use SHA-1 anymore, it uses\nHardened-SHA-1 (they just so happen to produce the same outputs\n99.99999999999...% of the time).\n\nThus the previous text was incorrect in asserting that:\n\n [...]As a result [of SHAttered], SHA-1 cannot be considered\n cryptographically secure any more[...]\n\nThat's not the case. We have a mitigation against SHAttered, *however*\nwe consider it prudent to move to work towards a NewHash should future\nvulnerabilities in either SHA-1 or Hardened-SHA-1 emerge.\n\nSigned-off-by: Ævar Arnfjörð Bjarmason \n---\n .../technical/hash-function-transition.txt | 29 +++++++++++++++----\n 1 file changed, 24 insertions(+), 5 deletions(-)\n\ndiff --git a/Documentation/technical/hash-function-transition.txt b/Documentation/technical/hash-function-transition.txt\nindex 34396f13ec..34b8b83a34 100644\n--- a/Documentation/technical/hash-function-transition.txt\n+++ b/Documentation/technical/hash-function-transition.txt\n@@ -28,11 +28,30 @@ advantages:\n address stored content.\n \n Over time some flaws in SHA-1 have been discovered by security\n-researchers. https://shattered.io demonstrated a practical SHA-1 hash\n-collision. As a result, SHA-1 cannot be considered cryptographically\n-secure any more. This impacts the communication of hash values because\n-we cannot trust that a given hash value represents the known good\n-version of content that the speaker intended.\n+researchers. On 23 February 2017 the SHAttered attack\n+(https://shattered.io) demonstrated a practical SHA-1 hash collision.\n+\n+Git v2.13.0 and later subsequently moved to a hardened SHA-1\n+implementation by default, which isn't vulnerable to the SHAttered\n+attack.\n+\n+Thus Git has in effect already migrated to a new hash that isn't SHA-1\n+and doesn't share its vulnerabilities, its new hash function just\n+happens to produce exactly the same output for all known inputs,\n+except two PDFs published by the SHAttered researchers, and the new\n+implementation (written by those researchers) claims to detect future\n+cryptanalytic collision attacks.\n+\n+Regardless, it's considered prudent to move past any variant of SHA-1\n+to a new hash. There's no guarantee that future attacks on SHA-1 won't\n+be published in the future, and those attacks may not have viable\n+mitigations.\n+\n+If SHA-1 and its variants were to be truly broken Git's hash function\n+could not be considered cryptographically secure any more. This would\n+impact the communication of hash values because we could not trust\n+that a given hash value represented the known good version of content\n+that the speaker intended.\n \n SHA-1 still possesses the other properties such as fast object lookup\n and safe error checking, but other hash functions are equally suitable\n-- \n2.16.2.804.g6dcf76e118\n\n"},{"id":"343048","messageId":"CAGZ79kYcX6z6276c1R8k0qya56G5UzuM96mOxhAOtG7OFw=TqA@mail.gmail.com","threadId":"48156","inReplyTo":"20180326182708.26551-1-avarab@gmail.com","subject":"Re: [PATCH 0/2] doc hash-function-transition: minor & major clarifications","fromName":"Stefan Beller","fromEmail":"sbeller@google.com","sentAt":"2018-03-26T18:35:27Z","receivedAt":"2018-03-26T18:35:43Z","isPatch":true,"sender":{"key":"stefanbeller@gmail.com","avatar":"https://avatars.githubusercontent.com/u/455868?v=4"},"body":"On Mon, Mar 26, 2018 at 11:27 AM Ævar Arnfjörð Bjarmason \nwrote:\n\n> Having read through the hash-function-transition.txt again, a couple\n> of things jumped out at me:\n\n> Ævar Arnfjörð Bjarmason (2):\n> doc hash-function-transition: clarify how older gits die on NewHash\n\n> We weren't accurately describing how \"git status\" would die on NewHash\n> repos on new versions.\n\n> doc hash-function-transition: clarify what SHAttered means\n\n> I don't think we had a good summary of how SHA-1 vulnerabilities\n> overlap with concerns Git has, now that we've moved to the hardened\n> SHA-1.\n\n> I may very well have gotten this new summary subtly wrong though. So\n> please review.\n\n> .../technical/hash-function-transition.txt | 40 +++++++++++++++----\n> 1 file changed, 32 insertions(+), 8 deletions(-)\n\nBoth patches look good to me.\n\nStefan\n"},{"id":"343053","messageId":"CAPig+cS8kY-cmJcFVdmu9vU+2NP+YZmXuraaK9CBTyWBEy0jAQ@mail.gmail.com","threadId":"48156","inReplyTo":"20180326182708.26551-3-avarab@gmail.com","subject":"Re: [PATCH 2/2] doc hash-function-transition: clarify what SHAttered means","fromName":"Eric Sunshine","fromEmail":"sunshine@sunshineco.com","sentAt":"2018-03-26T19:03:25Z","receivedAt":"2018-03-26T19:03:31Z","isPatch":true,"sender":{"key":"sunshine@sunshineco.com","avatar":"https://avatars.githubusercontent.com/u/163641?v=4"},"body":"On Mon, Mar 26, 2018 at 2:27 PM, Ævar Arnfjörð Bjarmason\n wrote:\n> Attempt to clarify what the SHAttered attack means in practice for\n> Git. The previous version of the text made no mention whatsoever of\n> Git already having a mitigation for this specific attack, which the\n> SHAttered researchers claim will detect cryptanalytic collision\n> attacks.\n> [...]\n> Signed-off-by: Ævar Arnfjörð Bjarmason \n> ---\n> diff --git a/Documentation/technical/hash-function-transition.txt b/Documentation/technical/hash-function-transition.txt\n> @@ -28,11 +28,30 @@ advantages:\n> Over time some flaws in SHA-1 have been discovered by security\n> +researchers. On 23 February 2017 the SHAttered attack\n> +(https://shattered.io) demonstrated a practical SHA-1 hash collision.\n> +\n> +Git v2.13.0 and later subsequently moved to a hardened SHA-1\n> +implementation by default, which isn't vulnerable to the SHAttered\n> +attack.\n> +\n> +Thus Git has in effect already migrated to a new hash that isn't SHA-1\n> +and doesn't share its vulnerabilities, its new hash function just\n> +happens to produce exactly the same output for all known inputs,\n> +except two PDFs published by the SHAttered researchers, and the new\n> +implementation (written by those researchers) claims to detect future\n> +cryptanalytic collision attacks.\n> +\n> +Regardless, it's considered prudent to move past any variant of SHA-1\n> +to a new hash. There's no guarantee that future attacks on SHA-1 won't\n> +be published in the future, and those attacks may not have viable\n> +mitigations.\n> +\n> +If SHA-1 and its variants were to be truly broken Git's hash function\n\ns/broken/&,/\n\n> +could not be considered cryptographically secure any more. This would\n> +impact the communication of hash values because we could not trust\n> +that a given hash value represented the known good version of content\n> +that the speaker intended.\n"}]}