From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 7D5F81396D9 for ; Tue, 24 Oct 2017 13:26:00 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 41CC12BC084; Tue, 24 Oct 2017 13:25:53 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id EBC2A2BC065 for ; Tue, 24 Oct 2017 13:25:52 +0000 (UTC) Received: from pomiot (d202-252.icpnet.pl [109.173.202.252]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: mgorny) by smtp.gentoo.org (Postfix) with ESMTPSA id 07E5B33BF51; Tue, 24 Oct 2017 13:25:50 +0000 (UTC) Message-ID: <1508851547.25623.0.camel@gentoo.org> Subject: Re: [gentoo-dev] Manifest2 hashes, take n+1-th: 3 hashes for the tie-breaker case From: =?UTF-8?Q?Micha=C5=82_G=C3=B3rny?= To: gentoo-dev@lists.gentoo.org Date: Tue, 24 Oct 2017 15:25:47 +0200 In-Reply-To: <73ce6032-2c65-676c-cf5c-233810555df5@gentoo.org> References: <1508440120.19870.14.camel@gentoo.org> <26AE424C-19DF-4059-A7DE-8ED6D605FF2C@gentoo.org> <1508817879.1688.6.camel@gentoo.org> <1508818272.1688.7.camel@gentoo.org> <73ce6032-2c65-676c-cf5c-233810555df5@gentoo.org> Organization: Gentoo Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.24.5 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@lists.gentoo.org Reply-to: gentoo-dev@lists.gentoo.org Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Archives-Salt: bf69babb-cd86-41c3-95a8-34dee58121c0 X-Archives-Hash: d0cfcd60ad8fdf4beba451fe8a6c56e0 W dniu wto, 24.10.2017 o godzinie 13∶56 +0200, użytkownik Chí-Thanh Christopher Nguyễn napisał: > Michał Górny schrieb: > > Oh, and most notably, the speed loss will be mostly visible to users. > > An attacker would have to compute the additional hashes only > > if the fastest hash already matched, i.e. rarely. Users will have to > > compute them all the time. > > That is currently the case with portage, but not an inevitable consequence of > having 3 hash functions in the Manifest. Portage could be made to check only > one or two of them (even by default), giving the tie-breaking ability to > those who need it, and speeding up things for those who don't. No, it can't. The specification (GLEP 59) requires it to check all hashes. -- Best regards, Michał Górny