Re: HEADS UP: FreeBSD src repo transitioning to git this weekend

From: RW <rwmaillists_at_googlemail.com>
Date: Fri, 1 Jan 2021 16:56:51 +0000
On Thu, 31 Dec 2020 21:25:08 -0500
grarpamp wrote:


> > Is there any reason to think [bittorrent] insecure?  
> 
> Cost under $50k of compute to break sha-1, 

AFAIK you cannot break SHA-1 in the sense of creating data that
matches a specific hash. What you can do is create a collision between
two blocks of data, varying both blocks in the process. This makes
SHA-1 unsuitable for digital signatures.

A *third-party* attacker cannot create a bogus torrent using a
collision attack against SHA-1 because the attacker would need to match
a specific hash value. 

What may be possible is that the creator of the legitimate torrent
might create two torrents with the same hash, but this seems very
contrived and not very useful. It has all sorts of problems as a way of
delivering targeted malware.
Received on Fri Jan 01 2021 - 15:56:55 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:41:26 UTC