Re: [linux_var] SHA1 collision & git

To: linux_var - LUG di Varese e Provincia Mailing List <talking@ml.linuxvar.it>

Subject: Re: [linux_var] SHA1 collision & git

From: Lorenzo Lobba <lorenzo.lobba@gmail.com>

Date: Wed, 01 Mar 2017 16:34:32 +0000

Authentication-results: linuxvar.it; dkim=pass reason="2048-bit key; unprotected key" header.d=gmail.com header.i=@gmail.com header.b=LiZnRpke; dkim-adsp=pass; dkim-atps=neutral

Delivered-to: diegor@tiscali.it

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ml.linuxvar.it; s=mail; t=1488386087; bh=HbVFPRyC7coZz5cKsvwMNMjqUS0EVF29vGonCboPbPg=; h=References:In-Reply-To:From:Date:To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: Reply-To; z=References:=20<CAPsbc0+RMrCNEk6FUjN=3DwpuwHv6xmS6E=3D5X-Tvo8Wq4ke ssx+A@mail.gmail.com>=0D=0A=20<20170223230424.891feb1922f3cc30fe10 865b@gmx.co.uk>=0D=0A=20<20170224054816.kujso234wy6cwros@manillaro ad.local.home.trueelena.org>=0D=0A=20<CAPsbc0K78b62QnmV4xp6FXuCWhG 39GekV25xzQe68QRegqtaxg@mail.gmail.com>=0D=0A=20<20170224094935.tg xmmcb4hglzpyp5@manillaroad.local.home.trueelena.org>=0D=0A=20<26A5 8D73-3226-4272-977E-C5CAEB43BC26@gmx.co.uk>=0D=0A=20<2017022412073 7.e4uavwtfgtls3ccz@manillaroad.local.home.trueelena.org>|In-Reply- To:=20<20170224120737.e4uavwtfgtls3ccz@manillaroad.local.home.true elena.org>|From:=20Lorenzo=20Lobba=20<lorenzo.lobba@gmail.com>|Dat e:=20Wed,=2001=20Mar=202017=2016:34:32=20+0000|To:=20linux_var=20- =20LUG=20di=20Varese=20e=20Provincia=20Mailing=20List=20<talking@m l.linuxvar.it>|Subject:=20Re:=20[linux_var]=20SHA1=20collision=20& =20git|List-Id:=20linux_var=20-=20LUG=20di=20Varese=20e=20Provinci a=20Mailing=20List=0D=0A=20<talking.ml.linuxvar.it>|List-Unsubscri be:=20<http://ml.linuxvar.it/cgi-bin/mailman/options/talking>,=0D= 0A=20<mailto:talking-request@ml.linuxvar.it?subject=3Dunsubscribe> |List-Archive:=20<http://ml.linuxvar.it/pipermail/talking/>|List-P ost:=20<mailto:talking@ml.linuxvar.it>|List-Help:=20<mailto:talkin g-request@ml.linuxvar.it?subject=3Dhelp>|List-Subscribe:=20<http:/ /ml.linuxvar.it/cgi-bin/mailman/listinfo/talking>,=0D=0A=20<mailto :talking-request@ml.linuxvar.it?subject=3Dsubscribe>|Reply-To:=20l inux_var=20-=20LUG=20di=20Varese=20e=20Provincia=20Mailing=20List= 0D=0A=20<talking@ml.linuxvar.it>; b=eIz3kaipSoLEErbWdp5XYJEC6KulrqnxaLv0zLj8ouB52TAckqz3b347PqWBiQF+P wJ/tTABEkV307stLEiX7vCJ2S/LEWGrEdwW9bANP6NSxw9xDeDEH1ZS5Ou8X5hP2zL LuO4EN5Bvh+1DvUqsj2DlbqSHwVkkpP7VDqK2oK8=

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=VKOuw/EBlOpioH2l/va81K/xBpG8xBmerBI1ewIvwD0=; b=LiZnRpkeFBcuH9RLWru0rSN9+5ucWLNyHvJF4bIoXMWlJUDvWGDwGNpHCWvTHGD4cU ZUOpCz0POJMCtX7QEaDn3WMUzu0KwdOHLlcDKDTOM4ScONX2y4AbaJqIJ82q10cDbnbW mrmGrYO+/jVYSrgHPAJ1r0u366JiruQhVFZeSBpS69t0Jd/O5Nxu7HGRY5mSTmHpPhph ekN2O8ZW33nfX88Rhdb87Jtpg4VVbZ0Qq3F8pOaSODdH973QQyyR8X2wKKcNBkc1+5ta 9XU5c5AJO3IIotscKtPCHU3M64GkC/xlF9zVhbUrg+xC3Oweg5vqVps+82LBC40zyTu2 n6RA==

In-reply-to: <20170224120737.e4uavwtfgtls3ccz@manillaroad.local.home.trueelena.org>

List-archive: <http://ml.linuxvar.it/pipermail/talking/>

List-help: <mailto:talking-request@ml.linuxvar.it?subject=help>

List-id: linux_var - LUG di Varese e Provincia Mailing List <talking.ml.linuxvar.it>

List-post: <mailto:talking@ml.linuxvar.it>

List-subscribe: <http://ml.linuxvar.it/cgi-bin/mailman/listinfo/talking>, <mailto:talking-request@ml.linuxvar.it?subject=subscribe>

List-unsubscribe: <http://ml.linuxvar.it/cgi-bin/mailman/options/talking>, <mailto:talking-request@ml.linuxvar.it?subject=unsubscribe>

References: <CAPsbc0+RMrCNEk6FUjN=wpuwHv6xmS6E=5X-Tvo8Wq4kessx+A@mail.gmail.com> <20170223230424.891feb1922f3cc30fe10865b@gmx.co.uk> <20170224054816.kujso234wy6cwros@manillaroad.local.home.trueelena.org> <CAPsbc0K78b62QnmV4xp6FXuCWhG39GekV25xzQe68QRegqtaxg@mail.gmail.com> <20170224094935.tgxmmcb4hglzpyp5@manillaroad.local.home.trueelena.org> <26A58D73-3226-4272-977E-C5CAEB43BC26@gmx.co.uk> <20170224120737.e4uavwtfgtls3ccz@manillaroad.local.home.trueelena.org>

Reply-to: linux_var - LUG di Varese e Provincia Mailing List <talking@ml.linuxvar.it>

Sender: "Talking" <talking-bounces@ml.linuxvar.it>

da https://shattered.io/ ::

Who is capable of mounting this attack?
This attack required over 9,223,372,036,854,775,808 SHA1 computations.
This took the equivalent processing power as 6,500 years of single-CPU

Torvalds poi è tornato sull'argomento ribandento che il cielo non è caduto sulla testa.

https://plus.google.com/+LinusTorvalds/posts/7tp2gYWQugL

Senza entrare nel merito. Se avessi competenze e potenza di calcolo per fare un commit farlocco e infilarlo in un repository in modo tale da diffondere software malevolo, sicuramente avrei competenze e potenza di calcolo per fare attacchi più semplici e magari più remunerativi.

Ciao,

Lorenzo

_______________________________________________ Talking mailing list Talking@ml.linuxvar.it http://ml.linuxvar.it/cgi-bin/mailman/listinfo/talking

Follow-Ups:

Re: [linux_var] SHA1 collision & git
- From: Giovanni Orlandi <orlangio@gmail.com>

References:

[linux_var] SHA1 collision & git
- From: Lorenzo Lobba <lorenzo.lobba@gmail.com>
Re: [linux_var] SHA1 collision & git
- From: Riccardo Macoratti <r.macoratti@gmx.co.uk>
Re: [linux_var] SHA1 collision & git
- From: Elena ``of Valhalla'' <valhalla-l@trueelena.org>
Re: [linux_var] SHA1 collision & git
- From: Lorenzo Lobba <lorenzo.lobba@gmail.com>
Re: [linux_var] SHA1 collision & git
- From: Elena ``of Valhalla'' <valhalla-l@trueelena.org>
Re: [linux_var] SHA1 collision & git
- From: Riccardo Macoratti <r.macoratti@gmx.co.uk>
Re: [linux_var] SHA1 collision & git
- From: Elena ``of Valhalla'' <valhalla-l@trueelena.org>