Re: Which hash function to use, was Re: RFC: Another proposed hash function transition plan

From: Mike Hommey <mh@glandium.org>
Date: Jun 15, 2017, 11:05 UTC
Message-ID: <20170615110518.ordr43idf2jluips@glandium.org>
In-Reply-To: <alpine.DEB.2.21.1.1706151122180.4200@virtualbox>

On Thu, Jun 15, 2017 at 12:30:46PM +0200, Johannes Schindelin wrote:

Show 8 quoted lines

> Footnote *1*: SHA-256, as all hash functions whose output is essentially
> the entire internal state, are susceptible to a so-called "length
> extension attack", where the hash of a secret+message can be used to
> generate the hash of secret+message+piggyback without knowing the secret.
> This is not the case for Git: only visible data are hashed. The type of
> attacks Git has to worry about is very different from the length extension
> attacks, and it is highly unlikely that that weakness of SHA-256 leads to,
> say, a collision attack.

What do the experts think or SHA512/256, which completely removes the concerns over length extension attack? (which I'd argue is better than sweeping them under the carpet)

Mike