AFAIK the only "crypto" in git is GPG used to sign tags.
The content addressable data store where all the objects are kept is basically a filesystem where every filename is the SHA1 of its contents.
If you were to generate an object that was a SHA1 collision of an existing object and inject it via a commit (without access to filesystem, otherwise the point is sort of moot) then git won't overwrite the original object with that SHA1[1].
Maybe there's some other mechanism in Git that you're referring to that uses SHA1 as a MAC that I'm perhaps unaware of?
The content addressable data store where all the objects are kept is basically a filesystem where every filename is the SHA1 of its contents.
If you were to generate an object that was a SHA1 collision of an existing object and inject it via a commit (without access to filesystem, otherwise the point is sort of moot) then git won't overwrite the original object with that SHA1[1].
Maybe there's some other mechanism in Git that you're referring to that uses SHA1 as a MAC that I'm perhaps unaware of?
[1]: http://stackoverflow.com/questions/9392365/how-would-git-han...