Hacker News Reader

Comment by singpolyma3 | Hacker News Reader

signatures are basically always computed over hashes. The only problem here is that the hashes are not secure. And this is being fixed.

View on HN

No, but, the hashes are features of the content tracking system that hook it together. There is no reason that a signing scheme must rely on and trust those hashes!

We can round up the bits that make up a commit in a SHA-1-based repo, and sign those bits securely; this is a thing that is possible.

But is "commit" in this context a full snapshot or a delta? Because what you describe will only work for the former.

Regardless, commit hashes should be a security mechanism IMO. And not just commits. I should be able to treat _any_ content addressing system as having secure addresses. If you can engineer collisions you need to patch your system.

(Note that the above does not necessarily imply support for unconditionally forcing a fork of the entire git ecosystem.)

> There is no reason that a signing scheme must rely on and trust those hashes!

Not "must", but it would be stupid to use two sets of hashes without a compelling reason.

Two hashes are already used now: GPG isn't using a SHA-1 digest, but it's signing something that is using SHA-1 digests to refer to other objects.

(Inside GPG, there are configurable choices. It's possible to be using SHA-512, so in a SHA-256 git repo, you can still be using two hashes.)

As far as git is concerned, GPG is a black box and git feeds it normal git hashes, of which there is only one kind. This design makes sense.

For anything else, it depends on the exact scheme:

If git sent GPG the bits for the current commit specifically because it expects a better hash to be used, that would be silly to design on purpose (git should use a hash that meets all requirements). And it wouldn't protect history, which matters.

If git rounded up the bits of history, that would perform unacceptably badly.

If git used a better hash to secure history for signing purposes, and still had the normal hash elsewhere, that would be very silly to design on purpose because it should use the better hash for everything.

You are again talking about a fictional alternate reality in which git commit signatures do something like GPG_Sign(GPG_Signature_Hash(git commit || all objects referenced by commit))), instead of ours where it's GPG_Sign(GPG_Signature_Hash(git commit))), and the git commit is in turn some metadata and a git hash of a bunch of objects.

In our reality, the git hash is load bearing. You can disagree with that design choice, but you can't pretend to live in that alternate reality and design your solutions for this reality according to that.

> You are again talking about a fictional alternate reality

> can't pretend to live in that alternate reality

Discussions about solutions that don't exist or requirements not implemented are everyday occurrences and necessary.

I mean, if you're talking with a contractor about how your bathroom should look, that is a "fictional alternate reality", but you're not pretending to be living in it now.

I don't understand the purpose of the above engagement style, but it doesn't look like a great fit for HackerNews.

There's a difference between talking about a hypothetical path forward and a hypothetical different past. The latter can be intellectually interesting but is rarely part of normal project planning.

One difference is that I'm talking about the one and not the other. I have no interest in a hypothetical different past. This is a real issue; woulda coulda been talk, or told-you-so, etc, is what people engage in when they don't have any stake in something.

> We can round up the bits that make up a commit in a SHA-1-based repo, and sign those bits securely; this is a thing that is possible.

Yes but as my other comment explains, this is not particularly useful in and of itself.

It represents an increment in security which doesn't require switching to a SHA-256 repo.

Remember: bow out gracefully

you're arguing a position which indicates you don't know git's physical (textual) commmit structure.

Spend some quality time with:

    git cat-file -p HEAD

You'll get something like:

    tree ff1234...
    parent ccddef...

    fix(BUG-1245): my ai fixed it

Continue to `cat-file -p $TREE` and you'll get:

    file efef12... Makefile
    tree a1b2c3... src/
    file f0ea12... README.md

...and then it's turtles all the way down. It is (was!) safe to sign $HEAD (and only head!) because... it's turtles all the way down. Signing HEAD attaches IDENTITY (eg; torvalds@linux.com) to CONTENT (eg: src/@a1b2c3...) and TRANSITIVELY all the way down.

Your homework is to go run:

    time (
      git ls-files | xargs -n 1 sha256sum
    ) | sha256sum

...and then make a commit (nee: tag/note) containing that content as the commit message.

Your INSTINCT isn't wrong, your mechanics run counter to the practicalities of how git is designed to work, and the practicalities of the crucial defense that git-core is trying to divert: the ability to arbitrarily alter the signed(!!!) past, signed by third parties, with $ELDRITCH_SHA1 attacks.

You _still_ have to trust that GitHub.com or kernel.org won't get popped and start erroneously serving "signed but faulty" files and trees, but the urgency of moving to sha256 is about preventing faulty commits in the first place, which removes the requirement of "trust me bro!" relationship with the serving provider (or MITM).

> you're arguing a position which indicates you don't know git's physical (textual) commmit structure.

That is false; hopefully everyone here understands that it's a graph linked by hash "pointers", such as SHA-1. I have not seen evidence otherwise.

> time (

Of course I understand that it's (possibly vastly) more expensive to digest the content than just a top-level node. So what? Maybe someone would pay that, if they had the option.

> There is no reason that a signing scheme must rely on and trust those hashes!

Yes, but git's signing scheme(s) do, as do many third-party ones, so what are you arguing for, exactly?

The non-necessity of a fix in an alternate reality in which nobody uses git as documented? One in which git launched with a big disclaimer of "never trust our cryptographically secure hash function to be cryptographically secure" in its documentation and CLI outputs?

Because one thing is certainly a big no-go in our reality: git walking back these explicit and implicit (Hyrum's law) contracts because fixing a load-bearing hash function is hard.

Improving a signing scheme in the same repository format is less disruptive. It may not hit all the checkboxes, but it seems worth doing.

Reply on news.ycombinator.com