# Re: SHA1 collisions found

- From: Joey Hess \<hidden\>
- Date: 2017-02-23 18:22:03 
- List: git
- Page: https://ratatoskr.run/git/2017/02/7708593
- Thread: https://ratatoskr.run/git/2017/02/7708581/t.md

```text
Linus Torvalds wrote:
> What you describe pretty much already requires a pre-image attack,
> which the new attack is _not_.
> 
> It's not clear that the "good" object can be anything sane.

Generate a regular commit object; use the entire commit object + NUL as the
chosen prefix, and use the identical-prefix collision attack to generate
the colliding good/bad objects.

(The size in git's object header is a minor complication. Set the size
field to something sufficiently large, and then pad out the colliding
objects to that size once they're generated.)

-- 
see shy jo
```

## Attachments

- [signature.asc](https://ratatoskr.run/git/2017/02/7708593/attachment/0) (application/pgp-signature, 833 bytes)