Re: SHA1 collisions found
- From
Junio C Hamano <gitster@pobox.com>
- Date
- Mar 2, 2017, 20:43 UTC
- Message-ID
- <xmqqk287be9l.fsf@gitster.mtv.corp.google.com>
- In-Reply-To
- <CA+55aFwXaSAMF41Dz3u3nS+2S24umdUFv0+k+s18UyPoj+v31g@mail.gmail.com>
Linus Torvalds <torvalds@linux-foundation.org> writes:
Show 5 quoted lines
> Anyway, I do have a suggestion for what the "object version" would be, > but I'm not even going to mention it, because I want people to first > think about the _concept_ and not the implementation. > > So: What do you think about the concept?
My reaction heavily depends on how that "object version" thing works. When I think I have "variant #1" of an object and say
have 860cd699c285f02937a2edbdb78e8231292339a5#1
is there any guarantee that the other end has a (small) set of different objects all sharing the same SHA-1 and it thinks it has "variant #1" only when it has the same thing as I have (otherwise, it may have "variant #2" that is an unrelated object but happens to share the same hash)? If so, I think I understand how things would work within your "concept". But otherwise, I am not really sure.
Would "object version" be like a truncated SHA-1 over the same data but with different IV or something, i.e. something that guarantees anybody would get the same result given the data to be hashed?