From mboxrd@z Thu Jan 1 00:00:00 1970 Message-ID: To: 9fans@cse.psu.edu Subject: Re: [9fans] Venti security in view of SHA-1 exploit Date: Sat, 19 Feb 2005 12:26:05 -0700 From: andrey mirtchovski In-Reply-To: <9e8b82886fac51f78a70e17b6ba26813@telus.net> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Topicbox-Message-UUID: 10241d44-ead0-11e9-9d60-3106f5b1d025 > Has anyone given any thoughts on how Venti might be affected by the > recent weakening of the SHA-1 hash? > I can see one exploit in which a different block is returned from a > compromised venti server, that I accept because the fingerprint matches > the requested fingerprint. The issue of turnaround time isn't really > there as files live on Venti for a long time, and a compromised server > could at its leisure find a collision for some block I'm submitting. > The likelihood of such an exploit seems small, but should we be looking > for a better Venti hash? > > Paul things looked optimistic a few months ago: http://lists.cse.psu.edu/archives/9fans/2004-August/037686.html http://lists.cse.psu.edu/archives/9fans/2004-August/037695.html