1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
-
-
+
+
-
+
-
+
|
<title>Hash Policy</title>
<h2> Executive Summary, Or How To Avoid Reading This Article </h2>
There is much angst over the [http://www.shattered.io|Shattered attack]
against SHA1. If you are concerned about this and its implications for
Fossil, simply upgrade to Fossil 2.0 or later and the problem will go away.
Everything will continue to work as before. All of your legacy repositories
will continue to work and all of your old check-ins will still have the
Everything will continue to work as before. All of your legacy repositories
will continue to work and all of your old check-ins will still have the
same name. Your workflow will be unchanged.
But if you are curious and want a deeper understanding of what is
going on, read on...
<h2> Introduction </h2>
The first snapshot-based distributed version control system
The first snapshot-based distributed version control system
was [http://www.monotone.ca|Monotone]. Many of the ideas behind the design
of Fossil were copied from Monotone, including the use of a SHA1 hash to
assign names to artifacts. Git and Mercurial did the same thing.
The SHA1 hash algorithm is used only to create names for artifacts in Fossil
(and in Git, Mercurial, and Monotone). It is not used for security.
Nevertheless, when the [http://www.shattered.io|Shattered attack] found
two different PDF files with the same SHA1 hash, many users learned that
"SHA1 is broken". They see that Fossil (and Git, Mercurial, and Monotone)
use SHA1 and they therefore conclude that "Fossil is broken". This is
not true, but it is a public relations problem. So the decision
was made to migrate Fossil away from SHA1.
This article describes how that migration is occurring.
<h2>Use Of Hardened SHA1</h2>
In Fossil version 2.0 ([/timeline?c=version-2.0|2017-03-03]),
In Fossil version 2.0 ([/timeline?c=version-2.0|2017-03-03]),
the internal SHA1 implementation was changed from a generic
FIPS PUB 180-4 SHA1 implementation to a "Hardened SHA1"
[[https://github.com/cr-marcstevens/sha1collisiondetection|1]]
[[https://marc-stevens.nl/research/papers/C13-S.pdf|2]].
The Hardened SHA1 implement automatically detects when the artifact
being hashed is specifically designed to exploit the known weaknesses
|
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
-
+
|
someone says "SHA1 is broken, and Fossil uses SHA1, therefore Fossil is
broken", you can rebut the argument by pointing out that Fossil uses
<em>Hardened SHA1</em> not generic SHA1 and Hardened SHA1 is <em>not</em>
broken.
<h2>Support For SHA3-256</h2>
Prior to Fossil version 2.0 ([/timeline?c=version-2.0|2017-03-03]),
Prior to Fossil version 2.0 ([/timeline?c=version-2.0|2017-03-03]),
all artifacts in all Fossil repositories were named
by only a SHA1 hash.
Version 2.0 extended the [./fileformat.wiki|Fossil file format]
to allow artifacts to be named by either SHA1 or SHA3-256 hashes.
(SHA3-256 is the only variant of SHA3 that
Fossil uses for artifact naming, so for the remainder of this article
it will be called simply "SHA3". Similarly, "Hardened SHA1" will
|
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
|
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
|
-
+
-
-
+
+
|
seen, Fossil automatically switches to "sha3" mode and thereafter generates
only SHA3 hashes.
When a new repository is created by cloning, the hash policy is copied
from the parent.
For new repositories created using the
[/help?cmd=new|fossil new] command the default hash policy is "sha3".
[/help?cmd=new|fossil new] command the default hash policy is "sha3".
That means new repositories
will normally hold nothing except SHA3 hashes. The hash policy for new
repositories can be overridden using the "--sha1" option to the
"fossil new" command.
Even after upgrading to Fossil 2.1, Fossil will continue to use nothing
but SHA1 hashes on legacy repositories, thus preserving complete
compatibility with Fossil 1.37 and before. If you want Fossil to go
but SHA1 hashes on legacy repositories, thus preserving complete
compatibility with Fossil 1.37 and before. If you want Fossil to go
ahead and start using SHA3 hashes, change the hash policy to
"sha3" using a command like this:
<blockquote><verbatim>
fossil hash-policy sha3
</verbatim></blockquote>
|