| 1 |
Hi Jonas, |
| 2 |
|
| 3 |
On Tue, Apr 5, 2022 at 11:20 PM Jonas Stein <jstein@g.o> wrote: |
| 4 |
> > In other words, what are we actually getting by having _both_ SHA2-512 |
| 5 |
> > and BLAKE2b for every file in every Manifest? |
| 6 |
> |
| 7 |
> Implementations are often broken and we have to expect zero day attacks |
| 8 |
> on hashes and on signatures. Hence it does not hurt to have a second hash. |
| 9 |
> |
| 10 |
> It is very likely that we can not trust in X for a while in the next |
| 11 |
> years, but it is very unlikely that two different implementations are |
| 12 |
> affected. |
| 13 |
|
| 14 |
This is the part that doesn't really make any sense to me. The |
| 15 |
security of the system reduces to the SHA512 used by those GPG |
| 16 |
signatures. If SHA512 breaks, the fact that our Manifest files also |
| 17 |
use BLAKE2b isn't going to help us, since an attacker could |
| 18 |
presumably, in that case, forge the signatures that we're using as a |
| 19 |
root of trust. I don't see what a second hash buys us from a security |
| 20 |
perspective here. What attack model do you have where it makes sense? |
| 21 |
|
| 22 |
> Additionally calculating a second hash does not cost anything. |
| 23 |
|
| 24 |
How is that possible? Doesn't calculating two things always cost more |
| 25 |
than calculating one? If what you actually mean is, "performance is |
| 26 |
not important," we can discuss that, but it sounds like you're saying |
| 27 |
that there's zero performance impact. How does that work exactly? Is |
| 28 |
only one calculated at emerge time or something clever like that? |
| 29 |
|
| 30 |
Jason |
Archives