[IMP] web: upgrade the cache to use SHA2 over SHA1

SHA-1 is a cryptographic hash function that have weaknesses known since
2005, it has been deprecated by the NIST [1] about 10 years ago in 2011
and Google [2] have been able to perform a collision attack in 2017.

We use SHA-1 in order to generate unique URL for resources that can be
cached by the browser: assets bundle, translations, qweb templates and
qweb images.

Although practical attacks still requires quite a lot of computational
resources, it is time to upgrade SHA-1 to SHA-2.

We have selected the SHA-512/256 variant of the SHA-2 algorithm as
replacement for SHA-1 for the following reasons:

* On 64 bits platform, SHA-512 is the fastest SHA-2 variant, it is only
  ~1.5x slower than SHA-1. [3]
* Keeping only the 256 foremost bits protects against both collision
  attacks and length extension attacks.
* The hexadecimal digest is only 24 chars longer than SHA-1 which is
  nice to have somewhat short URLs.

We have not used SHA-3 because:

* At the moment of writing, it is too slow (~3x slower than SHA-1) [3]
* It is not guaranteed to be available with the Python 3.5 `hashlib`
  module.
* One of the author of SHA-3 is Belgian.

[1] https://csrc.nist.gov/projects/hash-functions/nist-policy-on-hash-functions
[2] https://shattered.io/
[3] http://bench.cr.yp.to/results-hash.html
[4] http://www.commitstrip.com/en/2017/02/27/the-sha-1-alternative/

2 files changed, 3 insertions, 3 deletions

diff --git a/odoo/addons/base/models/assetsbundle.py b/odoo/addons/base/models/assetsbundle.py
index d1554594aa3..e46a779dd28 100644
--- a/odoo/addons/base/models/assetsbundle.py
+++ b/odoo/addons/base/models/assetsbundle.py
@@ -186,10 +186,10 @@ class AssetsBundle(object):
     def checksum(self):
         """
         Not really a full checksum.
-        We compute a SHA1 on the rendered bundle + max linked files last_modified date
+        We compute a SHA512/256 on the rendered bundle + max linked files last_modified date
         """
         check = u"%s%s" % (json.dumps(self.files, sort_keys=True), self.last_modified)
-        return hashlib.sha1(check.encode('utf-8')).hexdigest()
+        return hashlib.sha512(check.encode('utf-8')).hexdigest()[:64]
 
     def _get_asset_template_url(self):
         return "/web/content/{id}-{unique}/{extra}{name}{sep}{type}"
diff --git a/odoo/addons/base/models/ir_http.py b/odoo/addons/base/models/ir_http.py
index 64ab86aea9b..5e142222eda 100644
--- a/odoo/addons/base/models/ir_http.py
+++ b/odoo/addons/base/models/ir_http.py
@@ -152,7 +152,7 @@ class IrHttp(models.AbstractModel):
             wdate = attach[0]['__last_update']
             datas = attach[0]['datas'] or b''
             name = attach[0]['name']
-            checksum = attach[0]['checksum'] or hashlib.sha1(datas).hexdigest()
+            checksum = attach[0]['checksum'] or hashlib.sha512(datas).hexdigest()[:64]  # sha512/256
 
             if (not datas and name != request.httprequest.path and
                     name.startswith(('http://', 'https://', '/'))):