Re: [gentoo-dev] (crazy?) proposal to reduce load and disk on mirrors

[Fred Van Andel <fava@gentoo.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On July 23, 2003 10:54 pm, Raimundo Bilbao wrote:

> Sound great, a P2P gentoo (?), but how do you protect against
> trojans, malware and stuffs like that?, is MD5 (AFAIK, currently the
> only checksum used) good enough?.

There are a couple of features to prevent against that kind of thing.

Only files that exist on the official distfiles mirrors will eligible 
for sharing. In other words users cannot submit new files into the 
system. 

MD5's will be used to protect each chunk of data as well as the entire 
file. All hashes will originate from a central server so there is no 
opportunity for a malicious user to create a compromised chunk of data 
and have it accepted by the system.

As for the security of MD5, there is no published instance of anyone 
finding 2 different datasets that produce an identical hash value. MD5 
is a 128 bit hash algorithm so in theory it would be be required to 
calculate approximately 1.2 * sqrt(2^128) different hashes in order to 
have a 50% chance of a single collision. That would require > 350 
billion gigabytes just to store the hashes. I believe MD5 to be secure 
enough for this application.

- -- 
Fred Van Andel
fava@gentoo.org
GPG KeyID: 76526AD599455482  
GPG fingerprint: 64E4 4BAB 9C99 D565 3E3C F5D0 7652 6AD5 9945 5482
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE/Hi5SdlJq1ZlFVIIRAn+rAKCTzLilqNQjFCfNt9hXkhlZUK/JWwCg8w+a
R6YWR9iUF6R0VBU2e18pQ5w=
=8wC3
-----END PGP SIGNATURE-----


--
gentoo-dev@gentoo.org mailing list