Hacker GitHub

← All repos

cr-marcstevens/sha1collisiondetection

View on GitHub ↗ ★ 1,423 C

Library and command line tool to detect SHA-1 collision in a file

19 mentions on Hacker News by 17 people: 2 stories, 17 comments · first 2017-02-23 · latest 2025-03-26

Mentions per year 19 mentions · busiest year 2017 (7)
20082026
AllStoriesComments NewestTopOldest
  1. …hash algorithms more easily in the future, but at least there are mitigations against attacks. [1]: https://github.com/cr-marcstevens/sha1collisiondetection [2]: https://github.blog/news-insights/company-news/sha-1-collisi...
    comment by kbolino · 2025-03-26 · in Whose code am I running in GitHub Actions?
  2. …doppelganger", there is no real pressure. [0] https://marc-stevens.nl/research/papers/C13-S.pdf [1] https://github.com/cr-marcstevens/sha1collisiondetection
    comment by theamk · 2024-12-31 · in Colliding with the SHA prefix of Linux's initial Git commit
  3. …that detects some known problems, and in those cases returns a different answer. More info: < https://github.com/cr-marcstevens/sha1collisiondetection >. Git switched to SHA-1DC in its version 2.13 release in 2017. It's a decent stopgap…
    comment by dwheeler · 2022-12-15 · in NIST is announcing that SHA-1 should be phased out by Dec. 31, 2030
  4. …and (for example) replace it with a different hash only for inputs that would be a problem. https://github.com/cr-marcstevens/sha1collisiondetection i think git does this to eek more life out of sha1. I imagine you could take a similar…
    comment by bawolff · 2022-09-20 · in Hash collisions and exploitations – Instant MD5 collision
  5. ▲ 9
    Library and command line tool to detect SHA-1 collisions (2017)
    story by lucgommans · 2022-06-23 · 0 comments
  6. Yes. https://github.com/cr-marcstevens/sha1collisiondetection
    comment by versteegen · 2021-10-13 · in SHA-1 'fully and practically broken' by new collision (2020)
  7. They're more likely to employ counter-cryptanalysis [1] in the meantime. [1] https://github.com/cr-marcstevens/sha1collisiondetection
    comment by some_furry · 2020-09-04 · in GnuPG 2.2.23
  8. …git has collision detection code from sha1collisiondetection [1], making attacks even harder. [1]: https://github.com/cr-marcstevens/sha1collisiondetection
    comment by est31 · 2020-01-08 · in The first chosen-prefix collision for SHA-1
  9. …still be found. So we need to directly run hardened SHA1 on the data, which I believe is located at https://github.com/cr-marcstevens/sha1collisiondetection As seen in https://github.com/git/git/blob/master/sha1dc_git.c So I tested that…
    comment by Thorrez · 2020-01-08 · in The first chosen-prefix collision for SHA-1
  10. …that google provided as proof of their project's success. Price tag for that seems to be 11k. [1]: https://github.com/cr-marcstevens/sha1collisiondetection
    comment by est31 · 2020-01-07 · in The first chosen-prefix collision for SHA-1
  11. …will mitigate this new attack: https://twitter.com/realhashbreaker/status/11284190295369236... 1. https://github.com/cr-marcstevens/sha1collisiondetection
    comment by avar · 2019-05-14 · in A SHA-1 chosen-prefix collision attack
  12. …SHA-1DC. It's compatible with SHA-1, but will barf on the known collision attack against SHA-1: https://github.com/cr-marcstevens/sha1collisiondetection It's what Git uses by default, of course there's no guarantee that new SHA-1 attacks…
    comment by avar · 2019-02-20 · in Microsoft is Abandoning SHA-1 Hashes for Updates
  13. …final switch. If you want to know more about the patterns, see the sha1collisiondetection project: https://github.com/cr-marcstevens/sha1collisiondetection There's a research paper linked in the README.
    comment by peff · 2017-03-20 · in SHA-1 Collision Detection on GitHub.com
  14. The article links to this repo that actually does the work of finding possible collisions: https://github.com/cr-marcstevens/sha1collisiondetection My understanding of it is that it runs a SHA-1 and examines the internal state of the of…
    comment by koolba · 2017-03-20 · in SHA-1 Collision Detection on GitHub.com
  15. …talking about the automated method used on shattered.io to detect files which use the attack. See: https://github.com/cr-marcstevens/sha1collisiondetection They're basically building that into git so that if this specific collision attack…
    comment by Ajedi32 · 2017-02-27 · in SHA1 collisions make Git vulnerable to attacks
  16. The git mailing list talked about using ubc_check() from here: https://github.com/cr-marcstevens/sha1collisiondetection/blo...
    comment by tyingq · 2017-02-24 · in Reports of SHA-1's demise are considerably exaggerated
  17. https://github.com/cr-marcstevens/sha1collisiondetection implements a hash that is compatible with SHA-1 for all non-nefarious purposes, and has no known weakneses. Somebody already submitted patch series to (optionally) use it in git in…
    comment by jwilk · 2017-02-24 · in Linus' reply on Git and SHA-1 collision
  18. ▲ 1
    Library and command line tool to detect SHA-1 collision in a file
    story by hugomarisco · 2017-02-24 · 0 comments
  19. I love the fact that there is a tool for detecting any collision using this algorithm: https://github.com/cr-marcstevens/sha1collisiondetection and it's super effective: The possibility of false positives can be neglected as the…
    comment by Aissen · 2017-02-23 · in Announcing the first SHA-1 collision