Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What would be the point of a disclosure period? Nobody's going to fix SHA-1 in the next 90 days, or ever.


There is the "hardened sha-1" implementation that was released along with the sample collisions. It supposedly detects this type of attack and returns unique SHA-1 hashes. Not sure that's really a fix, but perhaps something someone would want to use short term.


The description seems curious. I'm not sure what the need for that would be? Retro-compat with existing stores/caches (but only in one direction) + mitigation against some collision attacks? hm I don't see the point. If you switch the hash function, I guess in the vast majority of cases you can switch it completely for something that is known to be really better, not a weird hack. Must fit a purpose in some Google software as a better than nothing quick&dirty temporary hack -- and I would not advice doing it in other contexts unless you know for sure you have no other choice.


I think that's roughly it. Temporary quick and dirty mitigation for anything where recomputing existing hashes is painful.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: