Received-SPF: pass (sog-mx-2.v43.ch3.sourceforge.com: domain of praus.net
	designates 209.85.215.42 as permitted sender)
	client-ip=209.85.215.42; envelope-from=petr@praus.net;
	helo=mail-la0-f42.google.com; 
MIME-Version: 1.0
In-Reply-To: <CAKaEYhK5ZzP8scbhyzkEU+WdWjwMBDzkgF+SrC-Mdjgo9G9RnA@mail.gmail.com>
References: <CAKaEYhK5ZzP8scbhyzkEU+WdWjwMBDzkgF+SrC-Mdjgo9G9RnA@mail.gmail.com>
From: Petr Praus <petr@praus.net>
Date: Mon, 1 Apr 2013 13:28:28 -0500
Message-ID: <CACezXZ94oDX1O7y7cgh+HvDj4QiDWmy1NVQ4Ahq=gmzhgmUaHQ@mail.gmail.com>
To: Melvin Carvalho <melvincarvalho@gmail.com>
Content-Type: multipart/alternative; boundary=089e012292fab445c404d950ca84
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] bitcoin pull requests
Precedence: list

--089e012292fab445c404d950ca84
Content-Type: text/plain; charset=UTF-8

An attacker would have to find a collision between two specific pieces of
code - his malicious code and a useful innoculous code that would be
accepted as pull request. This is the second, much harder case in the
birthday problem. When people talk about SHA-1 being broken they actually
mean the first case in the birthday problem - find any two arbitrary values
that hash to the same value. So, no I don't think it's a feasible attack
vector any time soon.

Besides, with that kind of hashing power, it might be more feasible to
cause problems in the chain by e.g. constantly splitting it.


On 1 April 2013 03:26, Melvin Carvalho <melvincarvalho@gmail.com> wrote:

> I was just looking at:
>
> https://bitcointalk.org/index.php?topic=4571.0
>
> I'm just curious if there is a possible attack vector here based on the
> fact that git uses the relatively week SHA1
>
> Could a seemingly innocuous pull request generate another file with a
> backdoor/nonce combination that slips under the radar?
>
> Apologies if this has come up before ...
>
>
> ------------------------------------------------------------------------------
> Own the Future-Intel&reg; Level Up Game Demo Contest 2013
> Rise to greatness in Intel's independent game demo contest.
> Compete for recognition, cash, and the chance to get your game
> on Steam. $5K grand prize plus 10 genre and skill prizes.
> Submit your demo by 6/6/13. http://p.sf.net/sfu/intel_levelupd2d
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>

--089e012292fab445c404d950ca84
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">An attacker would have to find a collision between two spe=
cific pieces of code - his malicious code and a useful innoculous code that=
 would be accepted as pull request. This is the second, much harder case in=
 the birthday problem. When people talk about SHA-1 being broken they actua=
lly mean the first case in the birthday problem - find any two arbitrary va=
lues that hash to the same value. So, no I don&#39;t think it&#39;s a feasi=
ble attack vector any time soon.<div style>

<br></div><div style>Besides, with that kind of hashing power, it might be =
more feasible to cause problems in the chain by e.g. constantly splitting i=
t.</div></div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote"=
>

On 1 April 2013 03:26, Melvin Carvalho <span dir=3D"ltr">&lt;<a href=3D"mai=
lto:melvincarvalho@gmail.com" target=3D"_blank">melvincarvalho@gmail.com</a=
>&gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 =
0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">

<div dir=3D"ltr"><div><div><div>I was just looking at:<br><br><a href=3D"ht=
tps://bitcointalk.org/index.php?topic=3D4571.0" target=3D"_blank">https://b=
itcointalk.org/index.php?topic=3D4571.0</a><br><br></div>I&#39;m just curio=
us if there is a possible attack vector here based on the fact that git use=
s the relatively week SHA1<br>


<br></div>Could a seemingly innocuous pull request generate another file wi=
th a backdoor/nonce combination that slips under the radar?<br><br></div>Ap=
ologies if this has come up before ...<br></div>
<br>-----------------------------------------------------------------------=
-------<br>
Own the Future-Intel&amp;reg; Level Up Game Demo Contest 2013<br>
Rise to greatness in Intel&#39;s independent game demo contest.<br>
Compete for recognition, cash, and the chance to get your game<br>
on Steam. $5K grand prize plus 10 genre and skill prizes.<br>
Submit your demo by 6/6/13. <a href=3D"http://p.sf.net/sfu/intel_levelupd2d=
" target=3D"_blank">http://p.sf.net/sfu/intel_levelupd2d</a><br>___________=
____________________________________<br>
Bitcoin-development mailing list<br>
<a href=3D"mailto:Bitcoin-development@lists.sourceforge.net">Bitcoin-develo=
pment@lists.sourceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/bitcoin-development=
" target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/bitcoin-de=
velopment</a><br>
<br></blockquote></div><br></div>

--089e012292fab445c404d950ca84--