* Re: [gentoo-dev] (crazy?) proposal to reduce load and disk on mirrors
@ 2003-07-24 7:30 99% ` Robin H.Johnson
0 siblings, 0 replies; 1+ results
From: Robin H.Johnson @ 2003-07-24 7:30 UTC (permalink / raw
To: Fred Van Andel; +Cc: gentoo-dev
[-- Attachment #1: Type: text/plain, Size: 1371 bytes --]
On Tue, Jul 22, 2003 at 11:42:26PM -0700, Fred Van Andel wrote:
> As for the security of MD5, there is no published instance of anyone
> finding 2 different datasets that produce an identical hash value. MD5
> is a 128 bit hash algorithm so in theory it would be be required to
> calculate approximately 1.2 * sqrt(2^128) different hashes in order to
> have a 50% chance of a single collision. That would require > 350
> billion gigabytes just to store the hashes. I believe MD5 to be secure
> enough for this application.
I'd be VERY careful with this.
http://www.rsasecurity.com/rsalabs/faq/3-6-6.html
I've seen much more recent research into it myself, along with a way of
making it SIGNIFICENTLY more difficult to break.
Namely, store the correct filesize along with the MD5 sum in a
verifiable fashion. Having file containing a list of tarballs and their
sizes, then providing a GPG signature for that file makes solves the
issue to a level such that even all the computers in the world in 10
years could not beat it [famous last words, after seeing the
crypto-attack on RSA keys using a massive NFS setup].
--
Robin Hugh Johnson
E-Mail : robbat2@orbis-terrarum.net
Home Page : http://www.orbis-terrarum.net/?l=people.robbat2
ICQ# : 30269588 or 41961639
GnuPG FP : 11AC BA4F 4778 E3F6 E4ED F38E B27B 944E 3488 4E85
[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2003-07-23 19:48 [gentoo-dev] The release of 1.4 and its impact on our mirrors Kurt Lieber
2003-07-24 7:35 ` [gentoo-dev] (crazy?) proposal to reduce load and disk on mirrors Håvard Wall
2003-07-24 5:54 ` Raimundo Bilbao
2003-07-23 6:42 ` Fred Van Andel
2003-07-24 7:30 99% ` Robin H.Johnson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox