Re: Re: Rpm-metadata Digest, Vol 16, Issue 4

seth vidal wrote:

>On Sun, 2005-02-20 at 13:02 -0600, Randy Zagar wrote:
>  
>
>>What makes you think I'm joking?
>>
>>The RPMs themselves contain SHA-1, MD5 checksums and GPG signatures.
>>
>>Why shouldn't the XML metadata files contain all relevant software
>>validation metadata?
>>    
>>
>
>Well, if you want to validate the pkgs you check gpg signatures, not
>sha1sums or md5sums.
>
>so instead of just adding more data w/o any real use to the metadata it
>would make more sense, to me, to work on gpg signing.
>

FYI: The problems are inseperable, DSA is based on SHA-1. If you can
create a SHA-1 hash collision, then you can spoof DSA.

Meanwhile, *please* don't include Yet Another Digest everywhere in 
rpm-metadata,
nor try to add duplicate md5+sha1 disgests. Even if SHA-1 collisions are 
now know easier
than what was originally thought, it's not exactly trivial to do, nor is 
it going to be
trivial to create a SHA-1 hash collision for quite some years yet (if ever).

And even then, having both MD5+SHA1 ain't the right answer, SHA257, or 
SHA386 or SHA512
raises the bar sufficiently.

73 de Jeff