SHA1 collision demo / example

New answer as of February 23rd 2017 For more than six years, the SHA1 cryptographic hash function underpinning Internet security has been at death’s door. Now it’s officially dead, thanks to the submission of the first known instance of a fatal exploit known as a “collision.” Previous answer (no longer accurate) There is no known … Read more

Git File Integrity

You can force Git to check the whole repository with git fsck. If a Git repository gets corrupted, you should get a new clone from a non-corrupted repository. Under normal operation Git should check parts of the repository as they are read, so it might take longer to notice some corruption, but it will be … Read more

How does the newly found SHA-1 collision affect Git?

Edit, late December 2017: Git version 2.16 is gradually acquiring internal interfaces to allow for different hashes. There is a long way to go yet. The short (but unsatisfying) answer is that the example files are not a problem for Git—but two other (carefully calculated) files could be. I downloaded both of these files, shattered-1.pdf … Read more

Password hash function for Excel VBA

Here’s a module for calculating SHA1 hashes that is usable for Excel formulas eg. ‘=SHA1HASH(“test”)’. To use it, make a new module called ‘module_sha1’ and copy and paste it all in. This is based on some VBA code from http://vb.wikia.com/wiki/SHA-1.bas, with changes to support passing it a string, and executable from formulas in Excel cells. … Read more

Why use SHA1 for hashing secrets when SHA-512 is more secure?

Most uses of SHA-1 are for interoperability: we use SHA-1 when we implement protocols where SHA-1 is mandated. Ease of development also comes into account: SHA-1 implementations in various languages and programming environment are more common than SHA-512 implementations. Also, even so most usages of hash functions do not have performance issues (at least, no … Read more

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)