Re: Debian should move away from MD5 (and at best also from SHA1) (in secure APT and friends)
* Wouter Verhelst <wouter@debian.org> [121013 10:56]:
> On Fri, Oct 12, 2012 at 09:17:32AM +0200, Bernhard R. Link wrote:
> > part at all) will only weaken security. So I think what you say is an
> > argument for keeping md5sum, so that noone think they can use that
> > information for security.
>
> This argument is based on the incorrect assumption that everyone in the
> world knows md5 is broken.
No it is based on the assumption that in that set of people that care
about security at all but have little enough knowledge of security
to mix up protection against faulty hardware with protection against
attackers there is at least one user having heared the meme
"md5 considered broken" and might combine those half-knowledges to
the correct result that debsums is not about security against attackers.
Causing at least one user to not think they could use debsums as protection
against wilfull file modification by sticking with md5 is (given there are
no benefits from switching hashes at all) a very strong argument that
switching hashes for debsums to stick to the hashes it uses.
Bernhard R. Link
Reply to: