Re: Hash algorithm analysis

On Sun, Jul 22, 2018 at 12:38:41AM +0200, Johannes Schindelin wrote:

I agree (believe me, of all people, I agree) that hard-coding SHA-1 was a bad choice in retrospect. But I've solicited contributors' opinions because the Git Project needs to make a decision *for this project* about the algorithm we're going to use going forward.

I don't know your colleagues, and they haven't commented here. One person that has commented here is Adam Langley. It is my impression (and anyone is free to correct me if I'm incorrect) that he is indeed a cryptographer. To quote him[0]:

  I think this group can safely assume that SHA-256, SHA-512, BLAKE2,
  K12, etc are all secure to the extent that I don't believe that making
  comparisons between them on that axis is meaningful. Thus I think the
  question is primarily concerned with performance and implementation
  availability.

  […]

  So, overall, none of these choices should obviously be excluded. The
  considerations at this point are not cryptographic and the tradeoff
  between implementation ease and performance is one that the git
  community would have to make.

I'm aware that cryptographers tend to prefer algorithms that have been studied longer over ones that have been studied less. They also prefer algorithms built in the open to ones developed behind closed doors.

SHA-256 has the benefit that it has been studied for a long time, but it was also designed in secret by the NSA. SHA3-256 was created with significant study in the open, but is not as mature. BLAKE2b has been incorporated into standards like Argon2, but has been weakened slightly for performance.

I'm not sure that there's a really obvious choice here.

I'm at the point where to continue the work that I'm doing, I need to make a decision. I'm happy to follow the consensus if there is one, but it does not appear that there is.

I will admit that I don't love making this decision by myself, because right now, whatever I pick, somebody is going to be unhappy. I want to state, unambiguously, that I'm trying to make a decision that is in the interests of the Git Project, the community, and our users.

I'm happy to wait a few more days to see if a consensus develops; if so, I'll follow it. If we haven't come to one by, say, Wednesday, I'll make a decision and write my patches accordingly. The community is free, as always, to reject my patches if taking them is not in the interest of the project.

[0] https://public-inbox.org/git/CAL9PXLzhPyE+geUdcLmd=pidT5P8eFEBbSgX_dS88knz2q_LSw@mail.gmail.com/