4 ms·

>* Distribution software checksum. SHA1 is the most common digest provided (even MD5 for many). Maybe I'm mistaken, but isn't the purpose of those mainly to ve

>* Distribution software checksum. SHA1 is the most common digest provided (even MD5 for many). Maybe I'm mistaken, but isn't the purpose of those mainly to verify that you've downloaded the file correctly? At least, the use of MD5 suggests that this is the case.

anilgulecha 10y ago
Correct, and if you have 2 images that have the same hash, you can serve one or the other at different times. This is the attack.
- pgeorgi 10y ago
  If you can switch between the images, you can also switch hashes. Without a signature they serve _only_ for making sure the network didn't barf into your stream.
- deleted 10y ago
  [deleted]
- antoinealb 10y ago
  SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced. That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's). SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.
  - simias 10y ago
    You can use SHA for this purpose if you retrieve the hashes from a trusted and secured source. Buildroot does that for 3rd party packages for instance. It downloads the source from the original website (possibly completely non-secured) but then validates the checksum against a locally trusted hash list. Buildroot supports a variety of hash algorithms but many packages still use SHA-1.
  - jnwatson 10y ago
    No. Signatures provide the same amount of integrity protection. In fact, all practical asymmetric signature schemes sign a hash. If an attacker can control what somebody signs, he can switch out signed documents using this vulnerability.
    - antoinealb 10y ago
      well I would say that if an attacker controls what you sign, your security model is already toast, isn't it ?
      - anilgulecha 10y ago
        Not if you sign with an ideal cryptography hash. (Rather than spend expensive compute on signing the whole message, you create a hash, and sign that.) The big news here is that SHA1 is now definitively not a cryptographically secure hash.
  - BlackFly 10y ago
    To be complete, it should be pointed out that the signature techniques you mention are signing not the document itself but a hash of the document. This attack does allow a bait and switch attack on cryptographically signed documents that utilize SHA-1 as the hash.
- StavrosK 10y ago
  The GP probably means "that it wasn't corrupted during the download", as there are a few attack vectors for someone who could serve a different file (they could trivially serve a different hash).

anilgulecha 10y ago

Correct, and if you have 2 images that have the same hash, you can serve one or the other at different times. This is the attack.

pgeorgi 10y ago
If you can switch between the images, you can also switch hashes. Without a signature they serve _only_ for making sure the network didn't barf into your stream.
deleted 10y ago
[deleted]
antoinealb 10y ago
SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced. That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's). SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.
- simias 10y ago
  You can use SHA for this purpose if you retrieve the hashes from a trusted and secured source. Buildroot does that for 3rd party packages for instance. It downloads the source from the original website (possibly completely non-secured) but then validates the checksum against a locally trusted hash list. Buildroot supports a variety of hash algorithms but many packages still use SHA-1.
- jnwatson 10y ago
  No. Signatures provide the same amount of integrity protection. In fact, all practical asymmetric signature schemes sign a hash. If an attacker can control what somebody signs, he can switch out signed documents using this vulnerability.
  - antoinealb 10y ago
    well I would say that if an attacker controls what you sign, your security model is already toast, isn't it ?
    - anilgulecha 10y ago
      Not if you sign with an ideal cryptography hash. (Rather than spend expensive compute on signing the whole message, you create a hash, and sign that.) The big news here is that SHA1 is now definitively not a cryptographically secure hash.
- BlackFly 10y ago
  To be complete, it should be pointed out that the signature techniques you mention are signing not the document itself but a hash of the document. This attack does allow a bait and switch attack on cryptographically signed documents that utilize SHA-1 as the hash.
StavrosK 10y ago
The GP probably means "that it wasn't corrupted during the download", as there are a few attack vectors for someone who could serve a different file (they could trivially serve a different hash).