On Mon, Sep 14, 2015 at 1:01 PM, Warren Young <[email protected]> wrote:
> On Sep 14, 2015, at 12:11 PM, Scott Robison <[email protected]> > wrote: > > > > > Fossil would be free to switch to a different algorithm later if that > seemed like a good idea. > > > > Is this really a problem? Given that the checkin ID is generated from a > structured manifest file which is generated in part from sha1 hash values > from all included artifacts, it seems intractable to create a deliberately > colliding hash. > > If I were a black hat — and please realize that I have zero practice > trying to be one, so assume that a real black hat would be as much better > at this as Mario Andretti is better than me at driving really fast — and I > wanted to attack someone else’s Fossil repo, I would consider its use of > SHA-1 as at least “hopeful.” > > The first line of defense is the passwords of valid committers, which > presumably contain much less than 160 bits of entropy. All you need to do > is find one weak password. And if that seems like an impossible thing to > you, you haven’t been paying attention to the computer security news. > Fair enough. > So now you have checkin privileges on someone else’s Fossil repo. Now > what? Obviously you could just commit evil code to the trunk, but it would > be much neater if you could insert it into an arbitrary point in the > checkin tree, if for no other reason than to hide it from the timeline > page, to reduce your chances of getting caught. > > So yes, the question really does become, how difficult is it to forge a > consistent yet bogus SHA-1 hash? If the crypto folk are worried about it — > and a more conservative bunch of computer scientists you will not find — > I’d say there is probably cause to be worried. > Also fair enough. Though there would be the additional difficulty (though I don't know how difficult it would be) to convince the canonical repository to replace an old checkin with a crafted checkin. This seems unlikely to me given that the receiving repo (as I understand it) will say "I already have that ID, what about the next one". > Let me restate that last point, to be doubly clear: If Bruce “security > theater” Schneier is worried about SHA-1, *I* am worried about SHA-1. > > https://www.schneier.com/blog/archives/2005/02/sha1_broken.html > https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html > https://www.schneier.com/blog/archives/2012/10/when_will_we_se.html > https://konklone.com/post/why-google-is-hurrying-the-web-to-kill-sha-1 > > The first two links talk about an attack that made it possible to generate > a hash collision with difficult-to-obtain levels of technology…in 2005. > That’s 6 Moore’s Law generations ago, which comes to about a factor of 100 > in CPU cycles per dollar. > > The third link gives a budgetary estimate of what it took to attack SHA-1 > in 2012, with projections into the future that do not include an estimated > rate of change in attack effectiveness. Attacks never get weaker, only > stronger. > > If you’re only thinking of maladjusted individuals and bottom-feeding > criminal gangs doing this, you probably haven’t considered that there might > be at least one major world government which would like to covertly insert > a bit of code into a widely-used open source project. I wasn't really thinking of who might want to do it, just that sha1 isn't being used for cryptographic security and that would be covered by other means (GPG for example). Thanks for the thoughtful response vs the (all too often on the internet) approach of questioning my parentage or intellect. :) -- Scott Robison
_______________________________________________ fossil-users mailing list [email protected] http://lists.fossil-scm.org:8080/cgi-bin/mailman/listinfo/fossil-users
