[gentoo-dev] Re: possible trojan in openssh-3.4p1

[A.Waschbuesch]

Johannes Findeisen wrote:

> On Thursday 01 August 2002 15:39, Rob Kaper wrote:
>> On Thursday 01 August 2002 15:35, Terje Kvernes wrote:
>> >   if the checksum differ, which it would have, emerge will abort.
>> >   although, emerge logs do sound like a very good idea.
>>
>> For optimum security, emerge should check checksums from different
>> locations. One or two trusted servers (often even the same as the one
>> where the files reside, although that might not be true for gentoo)
>> can be compromised too easily.
>
> if this should be a option in portage, we always need to download two
> files from two servers to check if the md5sum are the same... :-(
> IMO it is good as it is. the gentoo-core team are providing a md5sum
> in the portage tree and that should be enough.
>

Hi Johannes,

as far as the above suggestion made by Terje is concerned You're right. 
Distributed checks could easily lead to "confusion", especially working 
with mirrors. But MD5 alone IS a joke when it comes to _security_ 
(here: proof of origin/unmodified developer version). It's quite good 
to check file corruption during data transfer. But that's it in my 
eyes. If one wants secure "origin" checks there's the need for gpg 
signing or something alike. Just using md5 someone who got write access 
to a portage-server could easily regenerate the sum and paste it into 
the ebuild including a modified SRC-URL.

OK. "Even" the OpenBSD devel core team didn't manage to integrate 
private keys that way (maybe in general they're chaotic). One big 
problem handling this would be/is/was the key availability for people 
downloading files ... at least it's like that dealing with some of the 
OBSD dev-staff ...

Andrew

-- 
Andreas Waschbuesch, GAUniversity KG MA FNZ FK01
eMail: awaschb@××××.de

Pete:   Waiter, this meat is bad.
Waiter: Who told you?
Pete:   A little swallow.