4 ms·
You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD
by avar 11y ago
You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM.
I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum.
What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all for SHA1 is preimage attacks. E.g. if I work for Canonical, make an Ubuntu ISO and you have to produce a malicious ISO with the same MD5 sum.
We should be considerate of collision / preimage attacks, but please don't spread FUD by conflating the two. Publishing MD5 sums for ISOs is just fine.
- maaku 11y agoCollision attacks matter if you don't (want to) trust the Ubuntu release team.
- Analemma_ 11y agoIf you don't trust the Ubuntu release team, why are you downloading Ubuntu to begin with? Your threat model makes no sense.
- nickodell 11y agoYou should think about this in terms of collision resistance. Canonical doesn't write most of the packages that go into a release.
- hansjorg 11y agoHow deterministic is the build process for an entire distro like this? And wouldn't updating just a single letter in a README just before release thwart the efforts of an external attacker?
- hatsunearu 11y agoWhat? Pretty sure you're wrong. Yes, MD5 preimage resistance is not broken (to a reasonable degree). If you have the Ubuntu 16.04 ISO (you do), and if you have its hash, the attack to craft a different ISO with the same hash is a collision attack. A preimage attack is if you had some hash y where y=H(x) where x is some file/whatever, and trying to find out possible values of u that give rise to y when you do H(u), without the knowledge of x.
- avar 11y agoNo. What you're describing is just a subset of preimage attacks. Not having knowledge of x is just one type of preimage attack, a "preimage resistance". You can also know x, then it's a "second-preimage resistance".[1] Which is not the same as a collision attack. Where you're trying to find x and y such that h(x) = h(y) without anyone specifying x or y in advance. By definition a collision attack is an attack where you specifically craft both x and y such that they exploit weaknesses in the algorithm. It's not enough to know an arbitrary x or y that someone else has made, because that value isn't going to be exploiting the weakness. 1. https://en.wikipedia.org/wiki/Preimage_attack https://en.wikipedia.org/wiki/Preimage_attack
- hatsunearu 11y agoyeah, you're right. my bad.
- mceachen 11y ago(how many sites on the internet have a discussion where people are both patient and civil with each other, and the discussion results in mutual understanding?)
- hatsunearu 11y agoHmm, I personally haven't seen action in discussion where this kinda stuff doesn't happen; maybe I just pick the comments I reply well.