SHA1 security implications

[John-Mark Gurney <jmg@newcontext.com>]

As mentioned on the call, SHA1 has been successfully attacked:
https://en.wikipedia.org/wiki/SHA-1#SHAttered_%E2%80%93_first_public_collision

The offical website:
https://shattered.io/

Also, as a reminder, attacks only get better, today it may have taken
110 years of GPU, but in a few years, it may drop to a few years.

If we depend upon semantec equivalence of the id, then we need to be
aware of this attack and the implications that it has.

The attack is able to take a known prefix and suffic, and generate a
middle part that collides w/ a different middle part...   It is likely
and possible that we could construct the format of the data to be hashed
to prevent this attack, but I do not know cryptography well enough to
inform people how to prevent it.

It'd be easiest to switch to a different algorithm, which if we aren't
doing UUIDv5, then it wouldn't be hard to do so.

-- 
John-Mark