Blessed BitErrant, Pilgrim of the Torrent

Patron of files downloaded from strangers, hashes that age badly, and anyone who checks the antivirus but not the SHA-256.

Life

On 5 March 2017, barely ten days after Google and CWI produced the first SHA-1 collision with SHAttered, Tamas Jos published BitErrant. His experiment built two different executables, one harmless and one malicious, that yielded the same .torrent file: one piece of the download could be swapped without the client noticing. The author himself called it a fun little exploit, not a serious one, but the lesson was serious enough: SHA-1 was no longer enough.

Prayer

O Blessed BitErrant, who wandered from peer to peer, let our downloads arrive whole and every piece be the one promised. Amen.

How to celebrate

Celebrated by checking downloads against modern hashes and moving to BitTorrent v2, which uses SHA-256.

A torrent hashed with SHA-1 carries water from anyone.