Re: Migrating away from SHA-1?

From: Theodore Ts'o <tytso@mit.edu>
Date: Apr 14, 2016, 22:40 UTC
Message-ID: <20160414224051.GD16656@thunk.org>
In-Reply-To: <71A5D062-FCCD-42E5-80A8-AA9D8DE20604@zytor.com>

On Thu, Apr 14, 2016 at 10:28:50AM -0700, H. Peter Anvin wrote:

> 
> Either way, I agree with Ted, that we have enough time to do it
> right, but that is a good reason to do it sooner rather than later
> (see also my note about freezing the cryptographic properties.)

Sure, I think we should do it as well. But the fact that the attacker will likely need to get a commit into the tree in order to be able to carry out a collision attack means that it's easier (and probably less detectable) to get some underhanded C code into the tree. For one thing, you just need to introduce it via a patch ("Hi, I'm super eager newbie Nick, here's a cleanup patch!"), as opposed to getting a sublieutenant to accept a git pull request.

Also, remember that while we can write programs that look for suspicious git objects that have stuff hidden after the null terminator (in fact, maybe that would be a good thing to add to git, hmmm?), the state of the art in detecting underhanded C code which is deliberately designed to not be noticed by static code checkers (or humans doing a superficial code review, for that matter) is not particularly encouraging to me.

						- Ted