[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: md5sums files

On Wed, Mar 03, 2010 at 11:37:17AM +0000, Philipp Kern wrote:
> On 2010-03-03, Wouter Verhelst <wouter@debian.org> wrote:
> > This is where I disagree. When a checksum algorithm is compromised (and
> > MD5 *is* compromised), things only ever get worse, not better. Indeed,
> > MD5 preimage attacks are pretty hard *today*. But switching to something
> > more secure in preparation for the day when MD5 will be easily cracked
> > by every script kiddo around is *not* overkill.
> Sure, but to be honest, not even all packages managed to generate md5sums
> 'till now (with some quite core, omnipresent packages missing) so it seems out
> of scope for squeeze.  Maybe squeeze+1.

True but debsums can address these issues by system administrator
touch-ups as documented in manpage using:

 * /etc/apt/apt.conf.d/90debsums (debsums >= 2.0.7)
 * debsums_init(8)               (debsums >= 2.0.34 @ 2007)


Reply to: