From owner-freebsd-security@FreeBSD.ORG Mon Dec 3 07:48:03 2007 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E1E5816A41A for ; Mon, 3 Dec 2007 07:48:03 +0000 (UTC) (envelope-from freebsd-security@dfmm.org) Received: from dfmm.org (treehorn.dfmm.org [66.180.195.213]) by mx1.freebsd.org (Postfix) with ESMTP id C937713C461 for ; Mon, 3 Dec 2007 07:48:03 +0000 (UTC) (envelope-from freebsd-security@dfmm.org) Received: (qmail 33275 invoked by uid 1000); 3 Dec 2007 07:21:21 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 3 Dec 2007 07:21:21 -0000 Date: Sun, 2 Dec 2007 23:21:21 -0800 (PST) From: jason X-X-Sender: jason@treehorn.dfmm.org To: Norberto Meijome In-Reply-To: <20071203154412.461d0faf@meijome.net> Message-ID: <20071202230434.O27936@treehorn.dfmm.org> References: <20071203154412.461d0faf@meijome.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: freebsd-security@freebsd.org Subject: Re: MD5 Collisions... X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Dec 2007 07:48:04 -0000 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Not sure if you've read http://www.win.tue.nl/hashclash/SoftIntCodeSign/ . > > should some kind of advisory be sent to advise people not to rely solely > on MD5 checksums? Maybe an update to the man page is due ? : This is very old news. Most tools and systems seem to have switched to SHA variants: GPG (e.g., as used to sign FreeBSD security advisories) uses SHA1; ports distinfo files use SHA256; etc. The SHA variants have also been shown to be weaker than expected, too, but they're stronger than MD5, and it's not really clear at this point that there's anything better yet. The cryptographers are working on it: http://www.nist.gov/hash-competition I'm not sure why this made it to the front page of Slashdot again; identical attacks were on the front page of Slashdot three years ago (see the links at the bottom of your own URL...). Anyone in a position to understand what's going on here already knew. And anyone who doesn't understand these results is not going to be able to make any effective use of an advisory, and they're just going to get scared over nothing. Therefore, I don't think any kind of advisory is warranted. -Jason -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (FreeBSD) Comment: See https://private.idealab.com/public/jason/jason.gpg iD8DBQFHU65xswXMWWtptckRAp1qAKC5pGONKG3pdY11yzduGN0MYRlIwACgqKkd 3YhDBot1SAI4ALuOPi12hWQ= =8gRM -----END PGP SIGNATURE-----