‹ BackHN Continuity

Thread

Git 3.0's upcoming SHA-256 default will be a costly mistake

570 points · 536 comments · chmaynard

  1. GrantMoyer · · focus · HN ↗
    For reference: <a href="https:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;hash-function-transition" rel="nofollow">https:&#x2F;&#x2F;git-scm.com&#x2F;docs&#x2F;hash-function-transition

    Notably, a few of the featured author&#x27;s reservations appear to be addressed. According to the Git docs:

    - Objects can be referred to by their old, SHA-1 name or their new, SHA-256 name. This means old refs in docs and comments and such remain valid. The mapping between SHA-1 representations and SHA-256 representations appears to be intentionally bijective a.k.a. 1-to-1 (assuming no hash collisions), so that it could be re-computed on demand. The constraint of bijectivity appears to be the source of some limitations, ex. no mixed repos and submodules needing to match hash algroithm, but also bijectivity has strong benefits like the following items.

    - A bi-directional dictionary is maitained from SHA-1 to SHA-256 names so translations between the two don&#x27;t required re-hashing objects. This table could be recomputed on demand due to the bijection between names; it&#x27;s only a performance optimization.

    - A local SHA-256 converted repo (including an SHA-256 converted submodule) can interoperate with an SHA-1 only remote transparently to the remote server by translating names using the lookup table.

    - SHA-1 based GPG signatures will be preserved. A commit can be signed based on its SHA-1 representation, its SHA-256 representation, both, or neither. The bijection means the two types of signatures are in a sense interchangeable, or in other words the bijection between object representations implies an equivalence relation on signatures. An SHA-256 converted repo can quickly validate an SHA-1 based gpg signature using the lookup table.

    1. krupan · · focus · HN ↗
      If we are changing to sha256 because sha-1 is broken, how can we trust all those mappings and signatures?? This makes it even more confusing as to why this change is being made
      1. ilyagr · · focus · HN ↗
        If you trust the sha-256, you know the commits you have and their ancestors are not evil. So, the sha-1s for those commits can be trusted.

        You should also check the mapping table&#x27;s sha-256 hash, to know that it&#x27;s not evil.

        If you later get an evil commit trying to masquerade as one of those, Git will presumably notice that there are two commits with the same sha1 in the same repo, and bail loudly.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.