Re: Switching from SHA1 to a checksum type without known collisions in 1.15 working copy format

2023-01-22 Thread Evgeny Kotkov via dev
Daniel Shahaf writes: > > I can complete the work on this branch and bring it to a production-ready > > state, assuming there are no objections. > > Your assumption is counterfactual: > > https://mail-archives.apache.org/mod_mbox/subversion-dev/202301.mbox/%3C20230119152001.GA27446%40tarpaulin.sh

Re: Switching from SHA1 to a checksum type without known collisions in 1.15 working copy format

2023-01-22 Thread Nathan Hartman
Replying to multiple parts of this thread... On Sat, Jan 21, 2023 at 12:58 PM Karl Fogel wrote: > *nod* This issue isn't important enough to me to continue the > conversation -- I'd like for new hash algorithms to be possible, > and I think Evgeny's work on it is worthwhile, but I don't feel > ne

Re: Switching from SHA1 to a checksum type without known collisions in 1.15 working copy format

2023-01-22 Thread Daniel Shahaf
[ tl;dr: See last paragraph for a concrete question about ra_serf. ] Karl Fogel wrote on Fri, 20 Jan 2023 17:18 +00:00: > Yes. A hash is considered "broken" the moment security researches > can generate a collision. Consider the following uses of hash functions in our code: - FSFS rep-cache us

Re: Switching from SHA1 to a checksum type without known collisions in 1.15 working copy format

2023-01-22 Thread Daniel Shahaf
[See below a proposal that libsvn_wc not use any fixed hash function.] Martin Edgar Furter Rathod wrote on Sat, 21 Jan 2023 05:22 +00:00: > On 20.01.23 22:48, Karl Fogel wrote: >> On 20 Jan 2023, Nathan Hartman wrote: >>> We already can't store files with identical SHA1 hashes, but AFAIK the >>> o

Re: Switching from SHA1 to a checksum type without known collisions in 1.15 working copy format

2023-01-22 Thread Daniel Shahaf
To be clear, I wasn't vetoing changing the hash algorithm. I was vetoing making a change without discussion. If there is discussion and it results in consensus to change the algorithm, that'll be absolutely fine by me. Daniel Karl Fogel wrote on Sat, 21 Jan 2023 17:58 +00:00: > *nod* This issue