From owner-freebsd-security Wed Oct 9 16:46:29 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D085F37B404 for ; Wed, 9 Oct 2002 16:46:27 -0700 (PDT) Received: from fubar.adept.org (fubar.adept.org [63.147.172.249]) by mx1.FreeBSD.org (Postfix) with ESMTP id 8451143E7B for ; Wed, 9 Oct 2002 16:46:27 -0700 (PDT) (envelope-from mike@adept.org) Received: by fubar.adept.org (Postfix, from userid 1001) id 14492154D5; Wed, 9 Oct 2002 16:43:05 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by fubar.adept.org (Postfix) with ESMTP id 12015154D3; Wed, 9 Oct 2002 16:43:05 -0700 (PDT) Date: Wed, 9 Oct 2002 16:43:05 -0700 (PDT) From: Mike Hoskins To: Andrew McNaughton Cc: Erick Mechler , Subject: Re: md5 checksum server In-Reply-To: <20021010121731.O55435-100000@a2.scoop.co.nz> Message-ID: <20021009163635.V88705-100000@fubar.adept.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Thu, 10 Oct 2002, Andrew McNaughton wrote: > It's interesting then that we use MD5 sums for ports. Well, it's easy and has been done for quite awhile. ;) I think the basic PGP vs. MD5 idea is quite simple... If someone compromises the server the tarball lives on, then they can easily generate a malicious MD5 sum as well. If there was a 3rd party, you may be able to check the downloaded MD5 sum against a "trusted" sum, but the trusted sum couldn't really be trusted if it ultimately came from the same source. With PGP at least, the malicious party may generate a new fingerprint/etc. but it won't have the correct credentials. It's always difficult to figure out best practices in this scenario... Anytime you try to maintain trust while assuming a trusted resource (the server distributing tarballs in our case) has been compromised, you run into a lot of grey areas. (Obviously we want solutions that add trust while creating as little work as possible, and that can not just be "worked around".) To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message