5 ms·

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has

by csense 11y ago

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1] https://en.wikipedia.org/wiki/MD5 https://en.wikipedia.org/wiki/MD5

pritambaral 11y ago
They do provide SHA256SUMS. I guess MD5SUMS are there for legacy purposes. It is on users to stop using MD5SUMS and move to SHA256SUMS
thieving_magpie 11y ago
I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're downloading is worth anything. Any insight?
- defective 11y ago
  It's worth it for error-checking.
- eloisant 11y ago
  If they infect at the source, yes. But if just one mirror is infected, or one of the CDN servers, the attacker may not be able to change the checksum on the official site.
  - thieving_magpie 11y ago
    Ah - that makes sense. I knew their had to be an easy answer but I couldn't see it. Thanks
- fulafel 11y ago
  They GPG-sign the cryptographic checksums, see the .gpg files. If you don't verify the GPG sig, with Canonical's signing key obtained out of band, the checksum by itself is pretty useless as you describe. PS. anyone know of a CLI download tool that supports this format of GPG signatures? edit: why the downvotes for the parent? it's a fine question
  - blueblob 11y ago
    `gpg` is a command line tool for verifying these signatures and it is what `apt-key verify` uses in it's backend. you can download the signatures with `curl` or `wget`
- defvar 11y ago
  the checksums are gpg signed.
- lwf 11y ago
  If you have an existing Ubuntu system you trust, you can verify the authenticity of this release via: $ gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --verify SHA256SUMS{.gpg,} gpg: Signature made Thu 21 Apr 2016 10:40:38 UTC using DSA key ID FBB75451 gpg: Good signature from "Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 gpg: Signature made Thu 21 Apr 2016 10:40:38 UTC using RSA key ID EFE21092 gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092 $ sha256sum --ignore-missing -c SHA256SUMS ubuntu-16.04-desktop-amd64.iso: OK (You can ignore the `WARNING`s above, since you're explicitly telling `gpg` to use a keyring you trust)
  - thieving_magpie 11y ago
    I see. I'll do that from now on, that's pretty reassuring.
- rakoo 11y ago
  It doesn't protect against a malware being included by default, it protects against a malware being inserted on the wire, ie between Canonical's HDD and your HDD; if a malware is inserted at this point then the checksum should fail. Coincidentally it requires the checksum to be propagated through an other, more secure mean, so distributing the checksum on the very same site increases the chance for an attacker to act, however there is no other way as widespread as this to give the checksum anyway.
avar 11y ago
You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM. I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum. What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all for SHA1 is preimage attacks. E.g. if I work for Canonical, make an Ubuntu ISO and you have to produce a malicious ISO with the same MD5 sum. We should be considerate of collision / preimage attacks, but please don't spread FUD by conflating the two. Publishing MD5 sums for ISOs is just fine.
- maaku 11y ago
  Collision attacks matter if you don't (want to) trust the Ubuntu release team.
  - Analemma_ 11y ago
    If you don't trust the Ubuntu release team, why are you downloading Ubuntu to begin with? Your threat model makes no sense.
    - maaku 11y ago
      It is not trust in Canonical itself that is the problem, but the constant threat of coercion it puts on both the organization and the people that compromise it. This is why I work on generalized multi-signature schemes and deterministic builds.
      - maaku 11y ago
        s/compromise/comprise/
- nickodell 11y ago
  You should think about this in terms of collision resistance. Canonical doesn't write most of the packages that go into a release.
abiox 11y ago
i thought the use of md5 here was just to check that your download wasn't damaged, by comparing your hash to theirs.
- andersen1488 11y ago
  The purpose of publishing a public MD5 sum of a software release from the developer is to prevent tampering with an image. If I download an ISO of Ubuntu and check the MD5 value, and it doesn't match what Canonical says it should, then it's been tampered with.
  - e12e 11y ago
    I'd argue that there aren't any good reasons to use MD5 over sha256 today, but either way -- the plain checksums are mostly useful to make sure that iso's etc downloaded without error. The chance of a bad network connection or other random problem leaving you with an ISO and matching md5 in case of some random download error are extremely slim. For verifying downloads, you should be using the gpg signatures. And again, I don't think there's much of a reason to provide both signatures and plain hashes today, but: you might be in a jurisdiction where gpg is illegal (but then, you wouldn't be allowed to use Ubuntu anyway), or you might be bootstrapping from a system without gpg installed (eg: vanilla windows), but with sha256 installed, and a set of trusted CA-certs, so that you feel you can trust the downloaded hash. I'd argue it's probably a false sense of security -- in general the gpg-signatures (or more precisely the secret keys behind those signatures) -- should be easier to secure, and easier to tie to the trust-worthiness of the builds, than some random web server not being compromised. Or, put another way, in a scenario where the gpg signing key is compromised, it seems likely an attacker would also be able to to other stuff, like embed a back door etc. While there are many, many ways a mirror might be compromised, or TLS subverted. That's not to say that gpg is perfect, I just think verifying the gpg signatures get you closer to verifying what you (probably) care about: that you indeed have an install iso that is made in good faith by the Ubuntu release team, and to the best of their knowledge is ok.

by csense 11y ago

pritambaral 11y ago

They do provide SHA256SUMS. I guess MD5SUMS are there for legacy purposes. It is on users to stop using MD5SUMS and move to SHA256SUMS

thieving_magpie 11y ago

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're downloading is worth anything. Any insight?

defective 11y ago
It's worth it for error-checking.
eloisant 11y ago
If they infect at the source, yes. But if just one mirror is infected, or one of the CDN servers, the attacker may not be able to change the checksum on the official site.
- thieving_magpie 11y ago
  Ah - that makes sense. I knew their had to be an easy answer but I couldn't see it. Thanks
fulafel 11y ago
They GPG-sign the cryptographic checksums, see the .gpg files. If you don't verify the GPG sig, with Canonical's signing key obtained out of band, the checksum by itself is pretty useless as you describe. PS. anyone know of a CLI download tool that supports this format of GPG signatures? edit: why the downvotes for the parent? it's a fine question
- blueblob 11y ago
  `gpg` is a command line tool for verifying these signatures and it is what `apt-key verify` uses in it's backend. you can download the signatures with `curl` or `wget`
defvar 11y ago
the checksums are gpg signed.
lwf 11y ago
If you have an existing Ubuntu system you trust, you can verify the authenticity of this release via: $ gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --verify SHA256SUMS{.gpg,} gpg: Signature made Thu 21 Apr 2016 10:40:38 UTC using DSA key ID FBB75451 gpg: Good signature from "Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 gpg: Signature made Thu 21 Apr 2016 10:40:38 UTC using RSA key ID EFE21092 gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092 $ sha256sum --ignore-missing -c SHA256SUMS ubuntu-16.04-desktop-amd64.iso: OK (You can ignore the `WARNING`s above, since you're explicitly telling `gpg` to use a keyring you trust)
- thieving_magpie 11y ago
  I see. I'll do that from now on, that's pretty reassuring.
rakoo 11y ago
It doesn't protect against a malware being included by default, it protects against a malware being inserted on the wire, ie between Canonical's HDD and your HDD; if a malware is inserted at this point then the checksum should fail. Coincidentally it requires the checksum to be propagated through an other, more secure mean, so distributing the checksum on the very same site increases the chance for an attacker to act, however there is no other way as widespread as this to give the checksum anyway.

avar 11y ago

You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM. I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum. What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all for SHA1 is preimage attacks. E.g. if I work for Canonical, make an Ubuntu ISO and you have to produce a malicious ISO with the same MD5 sum. We should be considerate of collision / preimage attacks, but please don't spread FUD by conflating the two. Publishing MD5 sums for ISOs is just fine.

maaku 11y ago
Collision attacks matter if you don't (want to) trust the Ubuntu release team.
- Analemma_ 11y ago
  If you don't trust the Ubuntu release team, why are you downloading Ubuntu to begin with? Your threat model makes no sense.
  - maaku 11y ago
    It is not trust in Canonical itself that is the problem, but the constant threat of coercion it puts on both the organization and the people that compromise it. This is why I work on generalized multi-signature schemes and deterministic builds.
    - maaku 11y ago
      s/compromise/comprise/
nickodell 11y ago
You should think about this in terms of collision resistance. Canonical doesn't write most of the packages that go into a release.

abiox 11y ago

i thought the use of md5 here was just to check that your download wasn't damaged, by comparing your hash to theirs.

andersen1488 11y ago
The purpose of publishing a public MD5 sum of a software release from the developer is to prevent tampering with an image. If I download an ISO of Ubuntu and check the MD5 value, and it doesn't match what Canonical says it should, then it's been tampered with.
- e12e 11y ago
  I'd argue that there aren't any good reasons to use MD5 over sha256 today, but either way -- the plain checksums are mostly useful to make sure that iso's etc downloaded without error. The chance of a bad network connection or other random problem leaving you with an ISO and matching md5 in case of some random download error are extremely slim. For verifying downloads, you should be using the gpg signatures. And again, I don't think there's much of a reason to provide both signatures and plain hashes today, but: you might be in a jurisdiction where gpg is illegal (but then, you wouldn't be allowed to use Ubuntu anyway), or you might be bootstrapping from a system without gpg installed (eg: vanilla windows), but with sha256 installed, and a set of trusted CA-certs, so that you feel you can trust the downloaded hash. I'd argue it's probably a false sense of security -- in general the gpg-signatures (or more precisely the secret keys behind those signatures) -- should be easier to secure, and easier to tie to the trust-worthiness of the builds, than some random web server not being compromised. Or, put another way, in a scenario where the gpg signing key is compromised, it seems likely an attacker would also be able to to other stuff, like embed a back door etc. While there are many, many ways a mirror might be compromised, or TLS subverted. That's not to say that gpg is perfect, I just think verifying the gpg signatures get you closer to verifying what you (probably) care about: that you indeed have an install iso that is made in good faith by the Ubuntu release team, and to the best of their knowledge is ok.