Thread

1. amluto · 1790875631 · focus · HN ↗

   I don't understand why Git is not making the SHA-1 and SHA-256 modes far more compatible with each other.

   SHA1-hashed objects should be able to refer to SHA-256-hashed objects, although this seems somewhat pointless.

   But SHA-256-hashed objects should also be able to refer to SHA1-hashed objects, with a major caveat: if those objects themselves are part of a collision pair, then there is a genuine problem. But this is avoidable! Suppose that Linux decided to migrate to SHA-256. The upstream project could choose a pair of dates, say January 1 2027 and March 1 2027. Up to the first date, maintainers would be welcome to submit hashes of objects that are not yet in the repo but that they think they might submit later on, and, on that date, the upstream tree would finalize the list of these objects and reference it in the repo (with a new mechanism for this purpose). Effective the second date, the repo would start publishing SHA-256 commits and would never again accept a SHA1-hashed object that was not in the repo at the cutoff date or referenced as part of the Jan 1 block.

   And now it would be impossible to get a new SHA1 collision in to the repo.

   The only new git features needed would be:

   a) actual compatibility so that a SHA-256-hashed object could reference a SHA1-hashed object

   b) a new object type that's a list of allowed SHA1 hashes (or probably a tree of them) that is itself hashed with SHA-256 and a mechanism to link to one of these from a commit

   c) a policy mechanism to set a repo to only allow SHA1-hashed-objects that a reachable from a preconfigured SHA-256-hashed commit

   1. schacon · 1790875830 · focus · HN ↗

      Emily&#x27;s talk does a pretty good job of summarizing the issues with intermixing the hashes: <a href="https:&#x2F;&#x2F;youtu.be&#x2F;eJJp0RE7cd4" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;eJJp0RE7cd4

      1. RJIb8RBYxzAMX9u · 1790877675 · focus · HN ↗

         I skimmed the video, and I didn&#x27;t quite catch that. Near the end of the video, however, she did mention that interop is in the works[0].

         In any case, even if Git 3.0 were completely incompatible, it would suck, but it&#x27;s not the end of the world. You just treat it as if you were migrating from one SCM system to another. CVS -&gt; SVN -&gt; Perforce -&gt; Git -&gt; Git 3.0 -&gt; [...] been-there-done-that. This is something that both open-source and commercial projects have had to deal with over the years.

         Or maybe it would be a repeat of Python 2.x -&gt; 3.x. ¯\_(ツ)_&#x2F;¯ With AI assistance, hopefully porting the tooling over may go a lot quicker and smoother.

         [0] <a href="https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=eJJp0RE7cd4&amp;t=1134s" rel="nofollow">https:&#x2F;&#x2F;www.youtube.com&#x2F;watch?v=eJJp0RE7cd4&amp;t=1134s

         1. ba1afd89f34cb23 · 1790877912 · focus · HN ↗

            Her entire section 2 (starting at 6:12) is basically about why git does not and will never allow mixing of SHA1 and SHA256.

            The interop discussed is using copybara as a copy tool to move data from SHA1 based repos to SHA256 based repos and vice versa.

            1. RJIb8RBYxzAMX9u · 1790879605 · focus · HN ↗

               Thanks. I went back and re-watched that part, and her point&#x27;s that &quot;[a] tree&#x27;s cryptographic strength is equal to the weakest hash algorithm anywhere in the tree,&quot; and that&#x27;s fair. I also understand why Git 3.0 may not want to give user the choice, though I would still rather it be given.

               1. schacon · 1790880014 · focus · HN ↗

                  They do give the user the choice, but the default is changing. My point is not necessarily to rip out the SHA-256 option, but simply to not make it the default. Because then people will create repos in that format that do not understand the ramifications, where the opposite should be true.
               2. amluto · 1790882982 · focus · HN ↗

                  &gt; &quot;[a] tree&#x27;s cryptographic strength is equal to the weakest hash algorithm anywhere in the tree&quot;

                  This is simply wrong IMO, for two reasons:

                  1. The attack on SHA-1 is a collision attack. Once you have frozen a hash, you cannot attack it with existing cryptanalysis. If there were a preimage attack it would be a different story.

                  2. Even if there were preimage attacks, one could freeze a mapping from SHA1 hash to SHA-256 hash.

                  In fact, #2 seems like en excellent design. Objects could reference such a mapping, and a repo could disallow conflicting mappings (the mappings would only be accepted if the mapped objects are reachable from the mapping and the mapping is correct).

                  1. angry_octet · 1791027141 · focus · HN ↗

                     There were a number of unsupported assertions in the talk, and the lack of nuance in discussion made it seem like an announcement rather than a technical justification.

Unofficial Hacker News client; not affiliated with Y Combinator.