[gentoo-dev] Re: good time to stop using MD5's

[Chris Bainbridge]

On Tuesday 24 August 2004 20:23, Chris Gianelloni wrote:
> ...except in our case we're giving any possible attacker the "original
> message" in the original tarball/ebuild/Manifest/whatever...  They do
> not have to work from the arbitrary hash, at all.

As far as I understand what was shown against SHA, they have an attack that 
allows them to produce hash collisions, but they have to be able to change 
both texts. ie. they can produce two texts which have the same hash by 
generating both texts together. What they can't do is copy an existing file 
and then alter it to generate the same hash. (disclaimer - I haven't rtfp, 
please correct me here if I'm wrong!)

In the gentoo case, this means an attacker could generate a hash collision 
only if they have the ability to change the tarball/ebuild/patch before it is 
hashed by a gentoo developer. The easiest way to exploit this would be as a 
gentoo developer. I could add some trivial patch to glibc and generate it so 
that it collides with some backdoor code, and then cvs commit it. Normal 
people see this patch and it looks ok, but I can now do a man-in-the-middle 
attack and replace that file with my backdoor on any gentoo box. Interesting 
huh? You could do the same thing with user submitted patches, as long as they 
get added unaltered.

Anyway, the attacks so far have only been against md5, sha0, and 40 round 
sha1. Full sha1 is still secure, so that is what we should be using.

--
gentoo-dev@g.o mailing list