Re: [zooko@zooko.com: [Revctrl] colliding md5 hashes of human-meaningful

From: Junio C Hamano <junkio@cox.net>
Date: Jun 13, 2005, 20:46 UTC
Message-ID: <7vd5qqf0ii.fsf@assigned-by-dhcp.cox.net>
In-Reply-To: <20050613195038.9191.qmail@science.horizon.com>

>> So the problem is totally different from the way git uses a hash. In the 
>> git model, an attacker by definition cannot control both versions of a 
>> file, since if he controls just _one_ version, he doesn't need to do the 
>> attack in the first place!

> You are insufficiently paranoid, Grasshopper.

> The basic attack goes like this:

> - I construct two .c files with identical hashes.  One is something
>   useful; perhaps a device driver for some piece of hardware that my
>   desired target has.  The other is similar, but includes a remote
>   root explot.

>   (With an n-bit hash and an automated way to make harmless changes
>   to source files, I can generate 2^(n/2) variants of each and expect to
>   get a match, even in the absence of a better attack.)

> - I submit the first one to the Linux kernel.  It's valid and gets
>   merged.

I doubt that this part would work in practice.

Wouldn't you have to have some "garbage" in the early part of that driver source, probably in a C comment block or an otherwise unused string constant, that serves no apparent purpose, which is inserted by your "automated harmless changes" machinery?

Wouldn't that catch people's attention and cause them to question and reject that patch in the first place?

Wouldn't that mean you do not have control over even _one_ version, let alone _both_ versions?