SHA-1
SHA-1 is a cryptographic hash function designed by the United States National Security Agency that produces a 160-bit hash value. It was widely used for object identification in systems such as Git. In 2017, the SHAttered attack demonstrated that its collision resistance had been practically broken.
Core Facts
Git uses the SHA-1 hashing algorithm to generate a unique fingerprint for each file to achieve version storage.
Git uses the SHA-1 hash function to map input data of arbitrary length to a fixed 160-bit (40 hexadecimal character) hash value as the object identifier.
Timeline (last 90 days)
The b coefficient of each NIST curve is obtained by taking the SHA-1 of a 20-byte seed; the seeds were provided by the NSA and their origin has never been publicly explained.
The verifiable random generation process requires first selecting a public seed string, then repeatedly applying hash functions such as SHA-1 to map the output to curve parameters, so that anyone can rerun the verification with the same seed and algorithm.
From the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
Starting from version 2.13, Git introduced SHA-1 collision detection based on Marc Stevens' algorithm, capable of detecting SHAttered-type attacks
SHA-1 was designed by the National Security Agency and produces a 160-bit (40 hexadecimal character) hash value
A large number of third-party tools, CI/CD pipelines, IDE plugins, and automation scripts have hardcoded assumptions about 40-character SHA-1 hashes, and SHA-256's 64-character hashes will break these toolchains
A reasonable Git hash migration path would be to keep SHA-1 as the default until hosting platforms and mainstream toolchains broadly support SHA-256, and to provide a smooth conversion mechanism for migrating repositories between the two algorithms
Early v2 hidden service addresses were only 16 characters long, generated based on RSA-1024 keys and SHA-1 hashing.
iPhone backup filenames are SHA-1 hashes of the original path strings, distributed across 256 subdirectories based on the first two characters of the hash.
A packfile consists of three parts: a header magic number and version number, an object data section (where each object is stored with zlib compression using delta encoding), and a trailing SHA-1 checksum.
1 more timeline events
All Facts (15)
Git uses the SHA-1 hashing algorithm to generate a unique fingerprint for each file to achieve version storage.
70%VerifiedGit uses the SHA-1 hash function to map input data of arbitrary length to a fixed 160-bit (40 hexadecimal character) hash value as the object identifier.
65%UnverifiedSHA-1（Secure Hash Algorithm 1）由美国国家安全局设计，输入任意长度数据输出固定160位（40个十六进制字符）的哈希值
95%Unverified网站魔改SHA-1的常见手法包括多轮迭代、截取部分结果、拼接固定盐值和修改初始化向量
85%UnverifiedThe b coefficient of each NIST curve is obtained by taking the SHA-1 of a 20-byte seed; the seeds were provided by the NSA and their origin has never been publicly explained.
50%UnverifiedThe verifiable random generation process requires first selecting a public seed string, then repeatedly applying hash functions such as SHA-1 to map the output to curve parameters, so that anyone can rerun the verification with the same seed and algorithm.
50%UnverifiedFrom the public demonstration of the SHA-1 collision attack to the full deprecation of SHA-1 by mainstream browsers and CAs took nearly ten years.
50%UnverifiedSHA-1 was designed by the National Security Agency and produces a 160-bit (40 hexadecimal character) hash value
50%UnverifiedStarting from version 2.13, Git introduced SHA-1 collision detection based on Marc Stevens' algorithm, capable of detecting SHAttered-type attacks
50%UnverifiedA large number of third-party tools, CI/CD pipelines, IDE plugins, and automation scripts have hardcoded assumptions about 40-character SHA-1 hashes, and SHA-256's 64-character hashes will break these toolchains
50%UnverifiedA reasonable Git hash migration path would be to keep SHA-1 as the default until hosting platforms and mainstream toolchains broadly support SHA-256, and to provide a smooth conversion mechanism for migrating repositories between the two algorithms
50%UnverifiedEarly v2 hidden service addresses were only 16 characters long, generated based on RSA-1024 keys and SHA-1 hashing.
50%UnverifiediPhone backup filenames are SHA-1 hashes of the original path strings, distributed across 256 subdirectories based on the first two characters of the hash.
50%UnverifiedA packfile consists of three parts: a header magic number and version number, an object data section (where each object is stored with zlib compression using delta encoding), and a trailing SHA-1 checksum.
50%Unverified每个Git对象通过其内容的SHA-1哈希值唯一标识，形成内容寻址存储，实现天然去重
50%