Re: md5 package summaries on ftp server (was Re: System integrity)
On Thu, 24 Jun 1999, Chris Leishman wrote:
> > 1. Somebody else recently said (on this mailing list) that md5sums can
> > be "faked" by increasing the length of the file. Hence I would store the
> > file length in the md5sum file (like with the *.changes file and *.dsc
> > file).
>
> I still haven't seen any evidence of this...
Go read some of the crypto sites, if you can vary the size of the thing
you are computing a digest for and the digest does not include the size as
part of it's input then it is lots easier to attack MD5. You really should
include the size, ownership and permissions of each file+dir, then you can
make sure someone hasn't gone around and made something setuid that
shouldn't be or somesuch.
Jason
Reply to: