The First SHA1 Collision
CWI Institute in Amsterdam and Google genrate two PDF documents with the same SHA-1 digest. Google security blog - Announcing the first SHA1 collision SHA-1 collistion and Git If a file A with X hash in local repository and with X hash in remote (SHA-1 collistion between local and remote), would overwrite the local version? Nope. If it has the same SHA1, it means that when we receive the object from the other end, we will not overwrite the object we already have. So you have two cases of collision: the inadvertent kind, … The attacker kind … … So in this case, the collision is entirely a non-issue: you’ll get a “bad” repository that is different from what the attacker intended, but since you’ll never actually use his colliding object, it’s literally no different from the attacker just not having found a collision at all, but just using the object you already had (ie it’s 100% equivalent to the “trivial” collision of the identical file generating the same SHA1). See above. The only dangerous kind of collision is the inadvertent kind, but that’s obviously also the very very unlikely kind. Torvalds @ Git- Re: Starting to think about sha-256? ...