Re: [RFC] adding support for md5

From: Johannes Schindelin <johannes.schindelin@gmx.de>
Date: Aug 18, 2006, 10:21 UTC
Message-ID: <Pine.LNX.4.63.0608181209210.28360@wbgn013.biozentrum.uni-wuerzburg.de>
In-Reply-To: <Pine.LNX.4.63.0608172259280.25827@chino.corp.google.com>

Hi,

On Thu, 17 Aug 2006, David Rientjes wrote:

> I'd like to solicit some comments about implementing support for md5 as a 
> hash function that could be determined at runtime by the user during a 
> project init-db.

Make it a config variable, too, right?

It would be interesting to have other hashes, for three reasons:

1. they could be faster to calculate,
2. they could reduce clashes, and related to that,
3. it is possible that some day SHA1 is broken, i.e. that there is an 
   algorithm to generate a different text for a given hash.

As for 2 and 3, it seems MD5 is equivalent, since another sort of attacks was already successful on both SHA1 and MD5: generating two different texts with the same hash.

So, 1 could be a good reason to have another hash. IIRC SHA1 is about 25% slower than MD5, so it could be worth it.

However, you should know that there is _no way_ to use both hashes on the same project. Yes, you could rewrite the history, trying to convert also the hashes in the commit objects, but people actually started relying on naming commits with the short-SHA1.

I think it would be a nice thing to play through (for example, to find out how much impact the hash calculation has on the overall performance of git), but I doubt it will ever come to real use.

Ciao, Dscho