On Sep 14, 2015, at 12:11 PM, Scott Robison <[email protected]> wrote: > > > Fossil would be free to switch to a different algorithm later if that > > seemed like a good idea. > > Is this really a problem? Given that the checkin ID is generated from a > structured manifest file which is generated in part from sha1 hash values > from all included artifacts, it seems intractable to create a deliberately > colliding hash.
If I were a black hat — and please realize that I have zero practice trying to be one, so assume that a real black hat would be as much better at this as Mario Andretti is better than me at driving really fast — and I wanted to attack someone else’s Fossil repo, I would consider its use of SHA-1 as at least “hopeful.” The first line of defense is the passwords of valid committers, which presumably contain much less than 160 bits of entropy. All you need to do is find one weak password. And if that seems like an impossible thing to you, you haven’t been paying attention to the computer security news. So now you have checkin privileges on someone else’s Fossil repo. Now what? Obviously you could just commit evil code to the trunk, but it would be much neater if you could insert it into an arbitrary point in the checkin tree, if for no other reason than to hide it from the timeline page, to reduce your chances of getting caught. So yes, the question really does become, how difficult is it to forge a consistent yet bogus SHA-1 hash? If the crypto folk are worried about it — and a more conservative bunch of computer scientists you will not find — I’d say there is probably cause to be worried. Let me restate that last point, to be doubly clear: If Bruce “security theater” Schneier is worried about SHA-1, *I* am worried about SHA-1. https://www.schneier.com/blog/archives/2005/02/sha1_broken.html https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1 The first two links talk about an attack that made it possible to generate a hash collision with difficult-to-obtain levels of technology…in 2005. That’s 6 Moore’s Law generations ago, which comes to about a factor of 100 in CPU cycles per dollar. The third link gives a budgetary estimate of what it took to attack SHA-1 in 2012, with projections into the future that do not include an estimated rate of change in attack effectiveness. Attacks never get weaker, only stronger. If you’re only thinking of maladjusted individuals and bottom-feeding criminal gangs doing this, you probably haven’t considered that there might be at least one major world government which would like to covertly insert a bit of code into a widely-used open source project. _______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
