Re: RFC v3: Another proposed hash function transition plan
- From
Jonathan Nieder <jrnieder@gmail.com>
- Date
- Sep 26, 2017, 23:51 UTC
- Message-ID
- <20170926235158.GD19555@aiede.mtv.corp.google.com>
- In-Reply-To
- <alpine.DEB.2.21.1.1709262356360.40514@virtualbox>
Hi,
Johannes Schindelin wrote:
Show 7 quoted lines
> Sorry, you are asking cryptography experts to spend their time on the Git > mailing list. I tried to get them to speak out on the Git mailing list. > They respectfully declined. > > I can't fault them, they have real jobs to do, and none of their managers > would be happy for them to educate the Git mailing list on matters of > cryptography, not after what happened in 2005.
Fortunately we have had a few public comments from crypto specialists:
https://public-inbox.org/git/91a34c5b-7844-3db2-cf29-411df5bcf886@noekeon.org/ https://public-inbox.org/git/CAL9PXLzhPyE+geUdcLmd=pidT5P8eFEBbSgX_dS88knz2q_LSw@mail.gmail.com/ https://public-inbox.org/git/CAL9PXLxMHG1nP5_GQaK_WSJTNKs=_qbaL6V5v2GzVG=9VU2+gA@mail.gmail.com/ https://public-inbox.org/git/59BFB95D.1030903@st.com/ https://public-inbox.org/git/59C149A3.6080506@st.com/
[...]
> Let's be realistic. Git is pretty important to us, but it is not important > enough to sway, say, Intel into announcing hardware support for SHA3.
Yes, I agree with this. (Adoption by Git could lead to adoption by some other projects, leading to more work on high quality software implementations in projects like OpenSSL, but I am not convinced that that would be a good thing for the world anyway. There are downsides to a proliferation of too many crypto primitives. This is the basic argument described in more detail at [1].)
[...]
> On Tue, 26 Sep 2017, Jason Cooper wrote:
Show 7 quoted lines
>> For my use cases, as a user of git, I have a plan to maintain provable >> integrity of existing objects stored in git under sha1 while migrating >> away from sha1. The same plan works for migrating away from SHA2 or >> SHA3 when the time comes. > > Please do not make the mistake of taking your use case to be a template > for everybody's use case.
That said, I'm curious at what plan you are alluding to. Is it something that could benefit others on the list?
Thanks, Jonathan
[1] https://www.imperialviolet.org/2017/05/31/skipsha3.html