Re: [9fans] thoughs about venti+fossil

[Robert Raschke <rrplan9@tombob.com>]

Hi,

as far as I understand, there was recently a finding that SHA1 (or
MD5, can't remember off the top of my head) is potentially unsafe to
be used as a SIGNATURE of a document.  This is because somebody
managed to CONSTRUCT a text that ended up getting the same hash as
another (this is apparently not the easiest thing to do either).  And
that leads to potential falsification of data while still having a
supposedly valid signature.

This is completely different to what venti uses hashes for, where the
hash is computed on REAL (not constructed) data blocks for indexing
purposes.  If you manage to go out of your way and construct a block
that ends up clashing with an existing hash index, it doesn't matter,
because you won't break the existing data with it!

I get the impression that the former clouds the understanding of the
latter.

Robby