Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-14 Thread Eric D. Mudama
I hold my breath for weeks at a time, just incase something like this happens! I thought I was the only one! On 4/12/05, Theodore Ts'o <[EMAIL PROTECTED]> wrote: > So past a certain point, there is a probability that all of molecules > of oxygen in the room will suddenly migrate outdoors, and you

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-14 Thread Eric Rannaud
On Thu, 2005-04-14 at 01:30 -0700, Andy Isaacson wrote: > In particular, your defense here is specious. I agree that second > preimage is an unmanagably large problem for SHA1 for the forseeable > future (say, 8 years out), but collision results almost always result in > partially-controlled attac

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-14 Thread Andy Isaacson
On Tue, Apr 12, 2005 at 06:35:49PM +0200, Eric Rannaud wrote: > Simply put, the best known attack of SHA-1 takes 2^69 hash operations. > ( http://www.schneier.com/blog/archives/2005/02/sha1_broken.html ) > The attack is still only an unpublished paper and has not yet been > implemented. An attack i

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-12 Thread Eric Rannaud
Simply put, the best known attack of SHA-1 takes 2^69 hash operations. ( http://www.schneier.com/blog/archives/2005/02/sha1_broken.html ) The attack is still only an unpublished paper and has not yet been implemented. An attack is: you try as hard as you can to find a collision between two arbitra

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-12 Thread Theodore Ts'o
On Tue, Apr 12, 2005 at 12:40:21AM +0200, Pedro Larroy wrote: > > I had a quick look at the source of GIT tonight, I'd like to warn you > about the use of hash functions as content indexers. > > As probably you are aware, hash functions such as SHA-1 are surjective not > bijective (1-to-1 map), s

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-12 Thread Richard B. Johnson
On Mon, 11 Apr 2005, Petr Baudis wrote: Dear diary, on Tue, Apr 12, 2005 at 12:40:21AM CEST, I got a letter where Pedro Larroy <[EMAIL PROTECTED]> told me that... Hi Hello, I had a quick look at the source of GIT tonight, I'd like to warn you about the use of hash functions as content indexers. As

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-12 Thread Catalin Marinas
Magnus Damm <[EMAIL PROTECTED]> wrote: > On 4/12/05, Petr Baudis <[EMAIL PROTECTED]> wrote: > >> (iv) You fail to propose a better solution. > > I would feel safer with back end storage filenames based on email and > mtime together with an optional hash lookup that turns collisions into > worse per

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-12 Thread Barry K. Nathan
On Tue, Apr 12, 2005 at 12:51:39AM +0200, Petr Baudis wrote: > Dear diary, on Tue, Apr 12, 2005 at 12:40:21AM CEST, I got a letter > where Pedro Larroy <[EMAIL PROTECTED]> told me that... [snip...] > (iii) Your argument against comparing with the probability of a hardware > error does not make sens

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-11 Thread Magnus Damm
On 4/12/05, Petr Baudis <[EMAIL PROTECTED]> wrote: > (iv) You fail to propose a better solution. I would feel safer with back end storage filenames based on email and mtime together with an optional hash lookup that turns collisions into worse performance. But that's just me. / magnus - To unsub

Re: Call to atention about using hash functions as content indexers (SCM saga)

2005-04-11 Thread Petr Baudis
Dear diary, on Tue, Apr 12, 2005 at 12:40:21AM CEST, I got a letter where Pedro Larroy <[EMAIL PROTECTED]> told me that... > Hi Hello, > I had a quick look at the source of GIT tonight, I'd like to warn you > about the use of hash functions as content indexers. > > As probably you are aware, has

Call to atention about using hash functions as content indexers (SCM saga)

2005-04-11 Thread Pedro Larroy
Hi I had a quick look at the source of GIT tonight, I'd like to warn you about the use of hash functions as content indexers. As probably you are aware, hash functions such as SHA-1 are surjective not bijective (1-to-1 map), so they have collisions. Here one can argue about the low probability of