Re: Possible vulnerability to SHA-1 collisions

2012-11-28 Thread Andreas Ericsson
On 11/28/2012 01:27 AM, Jeff King wrote: On Tue, Nov 27, 2012 at 06:30:17PM -0500, Aaron Schrab wrote: At 18:07 -0500 27 Nov 2012, Jeff King p...@peff.net wrote: PS I also think the OP's sockpuppet creates innocuous bugfix above is easier said than done. We do not have SHA-1 collisions

Re: Possible vulnerability to SHA-1 collisions

2012-11-27 Thread Jeff King
On Sat, Nov 24, 2012 at 10:09:31AM -0800, Shawn O. Pearce wrote: On Sat, Nov 24, 2012 at 3:12 AM, Michael Hirshleifer 111...@caltech.edu wrote: Evil Guy creates 2 files, 1 evil and 1 innocuous, with the same SHA-1 checksum (including Git header). Mr. Evil creates a local branch with an

Possible vulnerability to SHA-1 collisions

2012-11-24 Thread Michael Hirshleifer
Evil Guy creates 2 files, 1 evil and 1 innocuous, with the same SHA-1 checksum (including Git header). Mr. Evil creates a local branch with an innocuous name like “test-bugfix”, and adds a commit containing a reference to the evil file. Separately, using a sockpuppet, Evil Guy creates an

Re: Possible vulnerability to SHA-1 collisions

2012-11-24 Thread Shawn Pearce
I don't think there is an issue the way you have tried to describe this scenario. On Sat, Nov 24, 2012 at 3:12 AM, Michael Hirshleifer 111...@caltech.edu wrote: Evil Guy creates 2 files, 1 evil and 1 innocuous, with the same SHA-1 checksum (including Git header). Mr. Evil creates a local branch