comment

diff --git a/doc/todo/encrypted_keys_in_git_repository/comment_4_e88664a0939b7bca730a61efb47d34ab._comment b/doc/todo/encrypted_keys_in_git_repository/comment_4_e88664a0939b7bca730a61efb47d34ab._comment
new file mode 100644 (file)
index 0000000..df0611b
--- /dev/null
+++ b/doc/todo/encrypted_keys_in_git_repository/comment_4_e88664a0939b7bca730a61efb47d34ab._comment
@@ -0,0 +1,14 @@
+[[!comment format=mdwn
+ username="joey"
+ subject="""comment 4"""
+ date="2023-01-02T19:03:34Z"
+ content="""
+I'm talking about a single file that the attacker already knows the content
+of, and wishes to determine if it's present in the repository. That takes a
+single scrypt operation, so scrypt's added difficulty is not relevant.
+
+If the attacker doesn't know the file content, and is trying to hash random
+values until they find one that matches the git-annex key, then a sha2 is
+equally good protection as scrypt, because the amount of work is
+computationally infeasible in both cases.
+"""]]