[Monotone-devel] Re: Crypto and SHA-1, was Policy branches - first steps

[Lapo Luchini]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Paul Crowley wrote:
> SHA-256, I think, until NIST name its successor in about five years.  See:
> http://venge.net/mtn-wiki/FutureCryptography

I could be nice if the policy could define one (or more!) "hash change
horizon" before of which the less secure hash is accepted: this way the
old history wouldn't need to be re-signed (thus losing the verifiability
of the original author's signature).
Of course the whole hash of the horizon's revisions could be signed (in
the policy) using the better hash, to protect them.
This way even a pre-image collision could generate a revision which
"seems to be" correct under the old signature, but can be verified as
invalid with the new one.

While we are talking of hashes: shouldn't we maybe follow Schneier's
suggestion to use "double SHA-256"?
The speed hit shouldn't be that bad (just one more "round" oh hashing)
and it would hinder length extension attacks.
This way a single collision couldn't be (easily) used to produce
infinite different collisions.

    Lapo
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIcBAEBAgAGBQJF49jLAAoJELBiMTth2oCD0sgQAImi2MpkbfTpXBrdMXIaqGsc
Eaj3icv6VpaBfIzM1TrnoN2PUEHa5RsUw+lJpe23YTezWgjq5VoWnkT9BUUjwxDU
WDgq2+6Vc1GMZz8QbbqCtv0+TxgFqVy81JjxVX4iJ46Sc4jUIZ2Y10kSf8Ja12h5
lmEtWKX6Ui0AR9j0+b0980wU/FoCoU6NcSJdujdOs7RvlcAdkYZkChP5PYDEO+kt
umzn1xARnx2GWChZpMQdFKtq4LDUnw8VHf3FGWpe9zdgVuVUacJOXjJLDStczLVj
1Hz2Uei6sW1LEG+dnonz+sKSoh+hHgYnxe4imSHP6Tfiz/XzlqCZfPTA/Ene7fn9
b0DfVdau5wn2Pnzk9B6HHSwvbUv7ikm+NkM+KPT8IKU5PMugwNMLFl8ppD9AFYcm
dMIk8QZTDNqbzzeKvlix+P8KYLJ6mXro4bitxeRS4f1KClNn4X/eprOxIRi1Vlcx
Gofz94u8zKzPjD/AecE6ah7KKg7DlDZBUjmyU+vTon/wtgn2OX+Y71sZ4/sB2JnK
bN6QSNIrBTine+w91QF1ghHTZyns+HtJMlW0fUU5M2DrOOYcYnGRrDsjOY82H+QM
ZAOhY6jgT40tbtGv70iQz+MSvCDR9OnKfGo+qMat+GaCw/dqjC8HN4xixAwPyR0r
bMXMmE1bihlZbs/1QGj8
=1S8e
-----END PGP SIGNATURE-----