3 ms·

So once again, what is the difference between this and an authorized list of integrity hash values? Edit: I misread the latter portion of your post. I see now.

• schoen 5y ago
  As some other replies pointed out, if that list is distributed in the same place as the software itself, an attacker can modify both of them at the same time. Maybe the list is digitally signed by the publisher, but then often the signing key is also distributed in the same place as the software itself (and also often used on the same infrastructure that the software was compiled on). Also, if the list of hash values is distributed only by a software publisher, the software publisher will get the ability to secretly backdoor some users, but not others, by creating two or more different versions of that list. Then it can deny the existence of the backdoored version to the public (or to itself, if the backdooring was done by an unauthorized insider!).
  • andrewmcwatters 5y ago
    Right, I can understand how this would be important now. Thank you.