Post Reopened by S.L. Barth - Reinstate Monica, schroeder
2 edited body
source | link

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well. 

Is there a way ina project which projects in places like sourceforge.netis starting and github.comusing git could do better to move all their infrastructure offmake sure that it uses SHA-1 to256 from the start instead of relying on SHA-256 or better1 . If yes, how ?

Comments, observations all welcome.

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well. Is there a way in which projects in places like sourceforge.net and github.com could do better to move all their infrastructure off SHA-1 to SHA-256 or better ?

Comments, observations all welcome.

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well. 

Is there a way a project which is starting and using git could do to make sure that it uses SHA-256 from the start instead of relying on SHA-1 . If yes, how ?

Comments, observations all welcome.

    Post Closed as "too broad" by Stephen Touset, PwdRsch, Xander, schroeder
1
source | link

How can we retire SHA1 in prefernce to SHA256 or SHA-3?

According to http://www.pcworld.com/article/3174676/security/sha-1-collision-can-break-svn-code-repositories.html and https://www.theregister.co.uk/2017/02/23/google_first_sha1_collision/ you could have two objects generating the same SHA-1 checksum. I am guessing this also effects in key generation as well. Is there a way in which projects in places like sourceforge.net and github.com could do better to move all their infrastructure off SHA-1 to SHA-256 or better ?

Comments, observations all welcome.