--QKdGvSO+nmPlgiQ/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Aug 18, 2004 at 02:21:18PM -0400, Mike Tancsa wrote: > At 01:58 PM 18/08/2004, Peter C. Lai wrote: > >Well while collisions are cryptographically significant, they don't > >necessarily impact any operational security of the the hash. (Since the > >collision merely means that there are possibly two inputs which will has= h=20 > >to > >the same digest). >=20 >=20 > As I have no crypto background to evaluate some of the (potentially wild= =20 > and erroneous) claims being made in the popular press* (eg=20 > http://news.com.com/2100-1002_3-5313655.html see quote below), one thing= =20 > that comes to mind is the safety of ports. If someone can pad an archive= =20 > to come up with the same MD5 hash, this would challenge the security of t= he=20 > FreeBSD ports system no ? >=20 > * "MD5's flaws that have been identified in the past few days mean that a= n=20 > attacker can generate one hash collision in a few hours on a standard PC.= =20 > To write a specific back door and cloak it with the same hash collision m= ay=20 > be much more time intensive. " At least the SHA-1 hash is still considered secure, and there's a whole series of SHA-nnn functions beyond that. I believe SHA-1 is already used implicitly by FreeBSD as the standard hash function used by gnupg(1) when digitally signing security alerts. Various SHA hashes are already given in a few ports distinfo files -- eg sysutils/coreutils, net/fping, misc/less -- although there seems to be no support in bsd.port.mk for checking anything other than MD5 as yet. I can't see any justification for giving up on MD5 just yet, but should the need eventually arise switching the ports over to an alternative hashing algorithm could be done relatively quickly. Cheers, Matthew --=20 Dr Matthew J Seaman MA, D.Phil. 26 The Paddocks Savill Way PGP: http://www.infracaninophile.co.uk/pgpkey Marlow Tel: +44 1628 476614 Bucks., SL7 1TH UK --QKdGvSO+nmPlgiQ/ Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (FreeBSD) iD8DBQFBI72giD657aJF7eIRAiwEAJ45lAa2amRV5pjixFgeSFVJLjx5mgCfRZNp qNvO90zpGHlm7AMl0kVTG4c= =TQEd -----END PGP SIGNATURE----- --QKdGvSO+nmPlgiQ/--