4 ms·
SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced. That is why most package manager include a form of crypto
by antoinealb 10y ago
SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced.
That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's).
SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.
- simias 10y agoYou can use SHA for this purpose if you retrieve the hashes from a trusted and secured source. Buildroot does that for 3rd party packages for instance. It downloads the source from the original website (possibly completely non-secured) but then validates the checksum against a locally trusted hash list. Buildroot supports a variety of hash algorithms but many packages still use SHA-1.
- jnwatson 10y agoNo. Signatures provide the same amount of integrity protection. In fact, all practical asymmetric signature schemes sign a hash. If an attacker can control what somebody signs, he can switch out signed documents using this vulnerability.
- antoinealb 10y agowell I would say that if an attacker controls what you sign, your security model is already toast, isn't it ?
- anilgulecha 10y agoNot if you sign with an ideal cryptography hash. (Rather than spend expensive compute on signing the whole message, you create a hash, and sign that.) The big news here is that SHA1 is now definitively not a cryptographically secure hash.
- BlackFly 10y agoTo be complete, it should be pointed out that the signature techniques you mention are signing not the document itself but a hash of the document. This attack does allow a bait and switch attack on cryptographically signed documents that utilize SHA-1 as the hash.