Re: [gentoo-portage-dev] Manifest signing

[Mike Auty]

At the moment,
	The MD5 (and theoretical SHA1) attacks create two pieces of data that 
hash to the same value.  As I understand it, neither piece of data can 
be chosen at the moment, and tend to be long and fairly random.    Also, 
the attacks that you're proposing to protect against must be coming from 
an untrusted user (since a dev with a signing key could always sign some 
malicious ebuild).
	So now the task is for an untrusted user to get a dev to sign some long 
random value that hashes to one thing, and then replace it with a 
different long random value when a user finally downloads it. It  must 
then be interpreted by portage and execute some malicious code (and if 
I've read news about savior correctly, this will be sandboxed until the 
merge stage, so most of the ebuild must be valid).  Does this not seem a 
little unlikely?  Will the cost of making every gentoo user (and devs 
when creating/testing ebuilds) hash every file (at least) twice over be 
less than the benefits of protecting against this attack?
	If portage can already handle multiple hash formats, then perhaps it 
would just be best to start shifting the default hashing algorithm from 
MD5 to SHA-256 or greater (which if you're going off schneier's tips for 
safety is just about safe at the moment), rather than requiring multiple 
hashes and guessing about their combined security?  By the time every 
manifest is signed, the digests inside it will presumably have been 
regenerated, and replaced by the latest default hash when that happened.
	Having to maintain backwards compatibility with old versions of portage 
is a good idea, however just how far back must be supported?  I'm afraid 
I don't know how long multiple hashes have been supported.  The earliest 
version in the tree at the moment is 2.0.51.22. If someone is getting 
new hashes, they must have synced recently and been informed that they 
need to upgrade portage.  To carry on with the old portage (moreover a 
version of portage so old it doesn't support multiple hashes) would be 
asking for incompatibilities to arise.  It would then surely be enough 
to leave MD5 sums only with the portage package (and any dependencies) 
so that portage could be successfully upgraded.
	Please note, this is not a "my crypto's bigger than your crypto" 
comment, it's just asking whether it's the most practical solution for 
the users or if there's another option?  Thanks for your time,
	Mike  5:)
-- 
gentoo-portage-dev@g.o mailing list