git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: How safe are signed git tags? Only as safe as SHA-1 or somehow safer?

From
Michael J Gruber <git@drmicha.warpmail.net>
Date
Nov 24, 2014, 10:15 UTC
Message-ID
<54730546.7000200@drmicha.warpmail.net>
In-Reply-To
<CACsJy8D-W_YrxMgUDScSmkNBKMVpRu_Kc0k6nsfyhmoLg5HBjg@mail.gmail.com>
Duy Nguyen schrieb am 24.11.2014 um 02:23:
Show 10 quoted lines
> On Tue, Nov 18, 2014 at 4:26 AM, Jeff King <peff@peff.net> wrote:
>> Yes, it is only as "safe as SHA-1" in the sense that you have GPG-signed
>> only a SHA-1 hash. If somebody can find a collision with a hash you have
>> signed, they can substitute the colliding data for the data you signed.
> 
> I wonder if we can have an option to sign all blob content of the tree
> associated to a commit, and the content of parent commit(s). It's more
> expensive than signing just commit/tag content. But it's also safer
> without completely ditching SHA-1.
>

This amounts to hashing the blob content with whatever hash you told your gpg to use (hopefully not sha1 ;) ) and signing that.

You're free to do that now and store the signature wherever your toolchain deems fit, say in a note or an annotated tag. But that approach won't sign the history, that is: If you are concerned about the breakability of sha1, then history is "possibly broken" no matter how you sign a commit object whose "parent" entry is based on the sha1 of its parent object.

Cheers Michael

Previous: Duy NguyenNext: Duy Nguyen
Message 9 of 21 in “How safe are signed git tags? Only as safe as SHA-1 or somehow safer?”
  1. Patrick SchleizerNov 16, 2014
  2. Jeff KingNov 17, 2014
  3. Patrick SchleizerNov 21, 2014
  4. Jason PyeronNov 21, 2014
  5. Jeff KingNov 22, 2014
  6. Jeff KingNov 22, 2014
  7. Fedor BrunnerNov 25, 2014
  8. Duy NguyenNov 24, 2014
  9. Michael J GruberNov 24, 2014
  10. Duy NguyenNov 24, 2014
  11. Duy NguyenNov 25, 2014
  12. Jeff KingNov 24, 2014
  13. Nico WilliamsNov 24, 2014
  14. Duy NguyenNov 25, 2014
  15. Jonathan NiederNov 25, 2014
  16. Duy NguyenNov 25, 2014
  17. Stefan BellerNov 25, 2014
  18. Jeff KingNov 25, 2014
  19. Duy NguyenNov 25, 2014
  20. Junio C HamanoNov 25, 2014
  21. brian m. carlsonNov 25, 2014

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.