Hacker News Reader

>...That means Git and unknown number of other widely used services that rely on SHA1 have THREE MONTHS to wean themselves and their users off the insecure function

https://arstechnica.com/security/2017/02/at-deaths-door-for-...

View on HN

That is a bit of hyperbole. Just as MD5 is a good hash function, as is SHA1 - they just are not good cryptographical hash functions. We've known this for more than a decade, so this is just confimation of what we already knew.

That said, it's relatively straight forward to upgrade Git for instance, but it will break all external linking to a repository unless they store both new and old hashes for existing commits. If the hashing function in Git should have been secure, it should not have been created with SHA1 in the first place, as it was known to be broke before development even began.

So apparently it's still in use for GPG and for Git? Why wouldn't that have been switched over to SHA-256 at some point?

Reply on news.ycombinator.com