Date: Thu, 23 Feb 2017 16:28:02 -0500
From: Peter Todd <pete@petertodd.org>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Message-ID: <20170223212802.GA7608@savin.petertodd.org>
References: <20170223181409.GA6085@savin.petertodd.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="OXfL5xGRrasGEqWY"
Content-Disposition: inline
In-Reply-To: <20170223181409.GA6085@savin.petertodd.org>
User-Agent: Mutt/1.5.23 (2014-03-12)
Cc: cryptography@metzdowd.com
Subject: Re: [bitcoin-dev] SHA1 collisions make Git vulnerable to attakcs by
 third-parties, not just repo maintainers
Precedence: list


--OXfL5xGRrasGEqWY
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Feb 23, 2017 at 01:14:09PM -0500, Peter Todd via bitcoin-dev wrote:
> Worth noting: the impact of the SHA1 collison attack on Git is *not* limi=
ted
> only to maintainers making maliciously colliding Git commits, but also
> third-party's submitting pull-reqs containing commits, trees, and especia=
lly
> files for which collisions have been found. This is likely to be exploita=
ble in
> practice with binary files, as reviewers aren't going to necessarily noti=
ce
> garbage at the end of a file needed for the attack; if the attack can be
> extended to constricted character sets like unicode or ASCII, we're in tr=
ouble
> in general.
>=20
> Concretely, I could prepare a pair of files with the same SHA1 hash, taki=
ng
> into account the header that Git prepends when hashing files. I'd then su=
bmit
> that pull-req to a project with the "clean" version of that file. Once the
> maintainer merges my pull-req, possibly PGP signing the git commit, I the=
n take
> that signature and distribute the same repo, but with the "clean" version
> replaced by the malicious version of the file.

Thinking about this a bit more, the most concerning avenue of attack is lik=
ely
to be tree objects, as I'll bet you you can construct tree objs with garbag=
e at
the end that many review tools don't pick up on. :(

--=20
https://petertodd.org 'peter'[:-1]@petertodd.org

--OXfL5xGRrasGEqWY
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJYr1PfAAoJECSBQD2l8JH7Ps4H/3b5d2Npej0JLtj4K9GGIDeq
q1mvGH8ofijSnbVgSUeLiE7z4llKe47ITAAS7ZxfSgCkrIWI9tCLE4HQWmRQjXH2
fySPVvEy+GJkmwE5wJ1v2vPYnG++JyjeVeM/iaV1pUjNhFMS2vVDuUd9esqwgSwI
XwBvn/4VRYxGUb8UQvgHuLb246/3q1ACgq2EO9hIIvMC9jRCCdTuf4xeiVegqEVM
PpfXNw9cdx3PbYgObzan5aOA3Uw+pRywfyQAsKucl8PBEqnzuOI1bp2UwNfhiQZO
EaoejM2oRhRe03CUeSx/ueYjnIcI2SKftxv3eyp2FaXOi6IsPLuLpLqpSadm+sA=
=lv4H
-----END PGP SIGNATURE-----

--OXfL5xGRrasGEqWY--