4 ms·

The price is not mainly computationally, but in complexity. You need to have a library implementing that alg, maintain that, make sure it has no security flaws.

by hannob 10y ago

The price is not mainly computationally, but in complexity. You need to have a library implementing that alg, maintain that, make sure it has no security flaws... And by the way, these Gentoo manifests, if you're worried about their cryptographic security there's something much bigger to worry about: For most users they're transmitted unprotected and unsigned via rsync. There are non-default ways to improve that, but the default is insecure. (It pains me to say this, because I'm a long time Gentoo dev, but it's a nasty truth about Gentoo's lack of security.) If you want to improve Gentoo's cryptographic integrity this is the first thing that should be worked on (either through a working signing system that would be acceptable by default or by switching to an authenticated transmission mechanism like git over https). This would be much more helpful than adding an obscure hash algorithm.

contingencies 10y ago
The current sync recommendation is emerge-webrsync: # emerge-webrsync Fetching most recent snapshot ... Trying to retrieve 20161021 snapshot from http://mirror.com/gentoo ... Fetching file portage-20161021.tar.xz.md5sum ... Fetching file portage-20161021.tar.xz.gpgsig ... Fetching file portage-20161021.tar.xz ... GPG is enough cryptographic assurance for me. (Edit: WTF! Either past-midnight has zapped my brain, or this is a total community pants down moment. emerge-webrsync doesn't actually verify the GPG signature by default, despite downloading it, and no warning is issued! One must follow the obtuse, well-buried instructions @ https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Features#Validated_Portage_tree_snapshots https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Features... to get it to actually verify ... I've added another bug @ https://bugs.gentoo.org/show_bug.cgi?id=597800 https://bugs.gentoo.org/show_bug.cgi?id=597800 about this... serious misfeature! Looks like for all intents and purposes if you want to own the average Gentoo box, having MITM on sync + emerge is enough! NSA must have been using that...)

by hannob 10y ago

contingencies 10y ago

The current sync recommendation is emerge-webrsync: # emerge-webrsync Fetching most recent snapshot ... Trying to retrieve 20161021 snapshot from http://mirror.com/gentoo ... Fetching file portage-20161021.tar.xz.md5sum ... Fetching file portage-20161021.tar.xz.gpgsig ... Fetching file portage-20161021.tar.xz ... GPG is enough cryptographic assurance for me. (Edit: WTF! Either past-midnight has zapped my brain, or this is a total community pants down moment. emerge-webrsync doesn't actually verify the GPG signature by default, despite downloading it, and no warning is issued! One must follow the obtuse, well-buried instructions @ https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Features#Validated_Portage_tree_snapshots https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Features... to get it to actually verify ... I've added another bug @ https://bugs.gentoo.org/show_bug.cgi?id=597800 https://bugs.gentoo.org/show_bug.cgi?id=597800 about this... serious misfeature! Looks like for all intents and purposes if you want to own the average Gentoo box, having MITM on sync + emerge is enough! NSA must have been using that...)