Re: SHA1 collisions found
- From
brian m. carlson <sandals@crustytoothpaste.net>
- Date
- Feb 25, 2017, 19:04 UTC
- Message-ID
- <20170225190410.anvb7ll7tlhwgm3t@genre.crustytoothpaste.net>
- In-Reply-To
- <CACsJy8AtQG8YXQ+YfSFifUxqtd==THj5weJK5jooyiRN0yamiQ@mail.gmail.com>
On Fri, Feb 24, 2017 at 04:42:38PM +0700, Duy Nguyen wrote:
Show 20 quoted lines
> On Thu, Feb 23, 2017 at 11:43 PM, Joey Hess <id@joeyh.name> wrote: > > IIRC someone has been working on parameterizing git's SHA1 assumptions > > so a repository could eventually use a more secure hash. How far has > > that gotten? There are still many "40" constants in git.git HEAD. > > Michael asked Brian (that "someone") the other day and he replied [1] > > >> I'm curious; what fraction of the overall convert-to-object_id campaign > >> do you estimate is done so far? Are you getting close to the promised > >> land yet? > > > > So I think that the current scope left is best estimated by the > > following command: > > > > git grep -P 'unsigned char\s+(\*|.*20)' | grep -v '^Documentation' > > > > So there are approximately 1200 call sites left, which is quite a bit of > > work. I estimate between the work I've done and other people's > > refactoring work (such as the refs backend refactor), we're about 40% > > done.
As a note, I've been working on this pretty much nonstop since the collision announcement was made. After another 27 commits, I've got it down from 1244 to 1119.
I plan to send another series out sometime after the existing series has hit next. People who are interested can follow the object-id-part* branches at https://github.com/bk2204/git.
-- brian m. carlson / brian with sandals: Houston, Texas, US +1 832 623 2791 | https://www.crustytoothpaste.net/~bmc | My opinion only OpenPGP: https://keybase.io/bk2204