Ævar Arnfjörð Bjarmason <avarab@xxxxxxxxx> writes: > @@ -125,19 +122,19 @@ Detailed Design > --------------- > Repository format extension > ~~~~~~~~~~~~~~~~~~~~~~~~~~~ > -A NewHash repository uses repository format version `1` (see > +A SHA-256 repository uses repository format version `1` (see > Documentation/technical/repository-version.txt) with extensions > `objectFormat` and `compatObjectFormat`: > > [core] > repositoryFormatVersion = 1 > [extensions] > - objectFormat = newhash > + objectFormat = sha256 > compatObjectFormat = sha1 Whenever we said SHA1, somebody came and told us that the name of the hash is SHA-1 (with dash). Would we be nitpicker-prone in the same way with "sha256" here? > @@ -155,36 +152,36 @@ repository extensions. > Object names > ~~~~~~~~~~~~ > Objects can be named by their 40 hexadecimal digit sha1-name or 64 > -hexadecimal digit newhash-name, plus names derived from those (see > +hexadecimal digit sha256-name, plus names derived from those (see > gitrevisions(7)). Seeing this hunk makes me respond to the above question with another question: "having to write sha-256-name, sha-1-name, gpgsig-sha-256, and sha-256-content is sort of ugly, no?" I guess names with two dashes are not _too_ bad, so I dunno. > Selection of a New Hash > ----------------------- > @@ -611,6 +608,10 @@ collisions in 2^69 operations. In August they published details. > Luckily, no practical demonstrations of a collision in full SHA-1 were > published until 10 years later, in 2017. > > +It was decided that Git needed to transition to a new hash > +function. Initially no decision was made as to what function this was, > +the "NewHash" placeholder name was picked to describe it. > + > The hash function NewHash to replace SHA-1 should be stronger than > SHA-1 was: we would like it to be trustworthy and useful in practice > for at least 10 years. This sentence needs a bit of updating to match the new paragraph inserted above. "should be stronger" is something said by those who are still looking for one and/or trying to decide. Perhaps something like this? ... the "NewHash" placeholder name was used to describe it. We wanted to choose a hash function to replace SHA-1 that is stronger than SHA-1 was, and would like it to be trustworthy and useful in practice for at least 10 years. Some other relevant properties we wanted in NewHash are: > @@ -630,14 +631,19 @@ Some other relevant properties: > 4. As a tiebreaker, the hash should be fast to compute (fortunately > many contenders are faster than SHA-1). > > -Some hashes under consideration are SHA-256, SHA-512/256, SHA-256x16, > +Some hashes under consideration were SHA-256, SHA-512/256, SHA-256x16, > K12, and BLAKE2bp-256. > > +Eventually in July 2018 SHA-256 was chosen to be the NewHash. See the > +thread starting at <20180609224913.GC38834@xxxxxxxxxxxxxxxxxxxxxxxxxx> > +for the discussion > +(https://public-inbox.org/git/20180609224913.GC38834@xxxxxxxxxxxxxxxxxxxxxxxxxx/) > +
