HEADS UP: FreeBSD src repo transitioning to git this weekend

[RW]

On Thu, 31 Dec 2020 21:25:08 -0500
grarpamp wrote:


> > Is there any reason to think [bittorrent] insecure?  
> 
> Cost under $50k of compute to break sha-1, 

AFAIK you cannot break SHA-1 in the sense of creating data that
matches a specific hash. What you can do is create a collision between
two blocks of data, varying both blocks in the process. This makes
SHA-1 unsuitable for digital signatures.

A *third-party* attacker cannot create a bogus torrent using a
collision attack against SHA-1 because the attacker would need to match
a specific hash value. 

What may be possible is that the creator of the legitimate torrent
might create two torrents with the same hash, but this seems very
contrived and not very useful. It has all sorts of problems as a way of
delivering targeted malware.