Finally a SHA-1 collision. TL;DR: same-prefix collision, don't panic *yet*, but Git better start thinking of SHA-256 and don't trust PDFs.
-
-
-
Replying to @chaitanya_gupta
Only if you believe SHA-3 is more secure than SHA-2. That is... not certain :-)
2 replies 0 retweets 2 likes -
Replying to @marcan42 @chaitanya_gupta
is it save to assume that SHA-256 is good enough for now?
1 reply 0 retweets 0 likes -
Replying to @Zennoe_de @chaitanya_gupta
We don't have any good reason to believe SHA-256 is insecure.
1 reply 0 retweets 0 likes -
SHA-2 vs SHA-3 boils down to "old and battle tested but sibling of broken SHA-1" and "new and unknown".
2 replies 0 retweets 0 likes -
Keccak/SHA-3 has actually been well-studied, see, e.g., http://eprint.iacr.org/2017/128 and refs therein
1 reply 0 retweets 0 likes -
Of course, but SHA-2 has been studied for longer due to its age.
1 reply 0 retweets 0 likes -
Replying to @marcan42 @KeccakTeam and
Basically I'm just saying the choice right now depends on factors other than security.
1 reply 0 retweets 0 likes
Of course the *real* lesson is to engineer in hash choice so you can switch if necessary.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.