<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" id="owaParaStyle"></style>
</head>
<body fpstyle="1" ocsi="0">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Joe Gordon asked:<br>
<div style="color: rgb(0, 0, 0); ">
<hr tabindex="-1" style="font-family: 'Times New Roman'; font-size: 16px; ">
<div id="divRpF481801" style="direction: ltr; "><font class="Apple-style-span" size="2"><b><br>
</b></font></div>
<div style="font-family: 'Times New Roman'; font-size: 16px; ">
<div>
<div>> Can SHA-1 collisions be generated? If so can you point me to the article? </div>
<div><br>
</div>
<div>Check Wikipedia on cryptographic hashing and especially "preimage attack"</div>
<div><br>
</div>
<div>To summarize, SHA-256 is effectively immune from a pre image attack. Even MD5 is effectiely immune from</div>
<div>co-incidental collisions until you have something on the order of 2**80 fingerprinted items. Amazon S3 has a</div>
<div>mere 2**40.</div>
</div>
<div><br>
</div>
<div>> Also why compare hashes in the first place? Linux 'Kenel Samepage Merging', which does page deduplication for KVM, does a full</div>
<div>> compare to be safe [1]. Even if collisions can't be generated, what are the odds of a collision (for SHA-1 and SHA-256) happening by </div>
<div>> chance when using Swift at scale? </div>
<div><br>
</div>
<div>The point of distributed reduplication is to avoid transfer of the data in the first place. If you did a safety check using a full compare</div>
<div>then you would have had to do the transfer first. A kernel looking for identical pages does not have that issue.</div>
<div><br>
</div>
<div>As for the chance of an accidental collision, you have to stop and think about how large a number 2**128 is (that's the</div>
<div>threshold for risking a birthday collision on a 256 bit key). Having multiple undetected network transmission errors back</div>
<div>to back is more likely.</div>
<div><br>
</div>
<div>Also I would recommend that SHA-256 be the *minimum* algorithm. Truly paranoid customers could select SHA-512.</div>
<div><br>
</div>
<div>ZFS has had SHA-256 for the purpose of detecting bit rot as the default for some time. It was a bit ambitious when ZFS</div>
<div>was designed, but with today's processors the computational overhead is neglible.</div>
<div><br>
</div>
<div><br>
</div>
<div> </div>
<div><br>
</div>
<div><br>
</div>
<div><br>
</div>
</div>
</div>
</div>
</body>
</html>