Re: Time to replace MD5?
On Wed, 13 Jun 2007, Florian Weimer wrote:
> > On Tue, 12 Jun 2007, Touko Korpela wrote:
> >> Debian Security Advisories currently contain MD5 checksums. As MD5 is no
> >> longer strong enough, maybe it should be replaced by SHA1 or SHA256?
> >
> > When combined with size information
>
> Size information doesn't buy you that much.
When we are talking about a binary blob that matches the *same* md5sum? Yes,
it does. Causing a MD5 colision with a message of the same size is far more
difficult.
> > AND the fact that it needs to be a valid .deb archive, they are
> > probably more than strong enough.
>
> That, and the "evil twin" package would have to be prepared by the
> securty team as well, which isn't a relevant scenario (because they
Would it?
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: