The requirement for git was integrity against random bit flips. Linus could have used CRC-160 instead (or any other good hash, e.g. modolu 2^160-x for small x that makes it prime), and get equally good protection against random bit flips, or honest mistakes.<p>However, Linus used SHA1, which offered two additional properties not strictly needed for the git use case:<p>1) Preimage resistance - that is, it is considered practically impossible in the next few decades to find an input file with a given hash<p>2) Collision resistance - that is, to find two different input files with the same hash.<p>preimage collision means that given a hash for a known repository state in which no file was controlled by an adversary at any point in time, you can be sure that if the hashes match, the content matches.<p>collision resistance means that given a hash for a known repository state, you can be sure that if the hashes match, the content matches. (Notice that with collision resistance, it is ok even if some files were controlled by an adversary).<p>When Linus chose SHA1, he got those two features &quot;for free&quot; (almost free - CRC-160 would be slightly faster to compute than SHA-1, but either is negligible in the grand scheme of things). But IIRC he explained several times that he wasn&#x27;t looking for them. It turns out that collision resistance is probably not a feature of SHA1.<p>Now, SHA1 is <i>still</i> useful to prove to yourself that nothing was changed provided that none of the files was created by an adversary (no preimage attack known yet). However, for proving the state of a repository to a 3rd party (who may assume you are an adversary), is no longer provided through SHA1.