git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Starting to think about sha-256?

From
Jeff King <peff@peff.net>
Date
Aug 28, 2006, 18:32 UTC
Message-ID
<20060828183252.GC2950@coredump.intra.peff.net>
In-Reply-To
<Pine.LNX.4.64.0608281034440.27779@g5.osdl.org>
On Mon, Aug 28, 2006 at 10:56:01AM -0700, Linus Torvalds wrote:
> However, the "earlier will override" is very much what you want from a 
> security standpoint: remember that the git model is that you should 
> primarily trust only your _own_ repository. So if you do a "git pull", the

This concept breaks down somewhat if you are pulling from two repositories (one good and one evil). If I pull from the evil repo first, that will become my "earlier" object, and I will never get the colliding object from the good repo.

Executing such an attack might not be that hard, either (once we get over that little hump of creating collisions at will!). The owner of 'evil' has to know a SHA1 that will be in 'good' before it makes it to 'good'. However, I imagine we frequently see SHA1s migrate from more central repos (like .../torvalds/linux-2.6.git) to less central ones (subsystem / port maintainers, etc).

-Peff
Previous: Linus TorvaldsNext: Linus Torvalds
Message 10 of 19 in “Starting to think about sha-256?”
  1. Jeff GarzikAug 27, 2006
  2. Krzysztof HalasaAug 27, 2006
  3. Linus TorvaldsAug 27, 2006
  4. Krzysztof HalasaAug 27, 2006
  5. Johannes SchindelinAug 27, 2006
  6. Linus TorvaldsAug 27, 2006
  7. David LangAug 28, 2006
  8. Linus TorvaldsAug 28, 2006
  9. Linus TorvaldsAug 28, 2006
  10. Jeff KingAug 28, 2006
  11. Linus TorvaldsAug 28, 2006
  12. Jeff KingAug 28, 2006
  13. Krzysztof HalasaAug 28, 2006
  14. Linus TorvaldsAug 28, 2006
  15. Krzysztof HalasaAug 28, 2006
  16. Linus TorvaldsAug 28, 2006
  17. Johannes SchindelinAug 28, 2006
  18. Linus TorvaldsAug 28, 2006
  19. Florian WeimerAug 29, 2006

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.