Bug 480038 - RFE: support stronger hashes than MD5
Summary: RFE: support stronger hashes than MD5
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: isomd5sum
Version: rawhide
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Radek Vykydal
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: fedora-sha2 477043
TreeView+ depends on / blocked
 
Reported: 2009-01-14 17:20 UTC by Miloslav Trmač
Modified: 2018-01-26 23:25 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-01-26 23:25:19 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Miloslav Trmač 2009-01-14 17:20:56 UTC
MD5 has known weaknesses and should be eventually phased out, it would be nice if newer hashes (such as SHA-2) were supported.  The data currently created by implantisomd5 consume less than half of the application area, so there is enough space for adding a single SHA-256 hash computed over the whole image, which should not break compatibility with older versions of checkisomd5.

Comment 2 Jeremy Katz 2009-01-14 17:57:03 UTC
Given that collision resistance isn't at all the concern behind having the embedded md5sum, I'm not sure that it's really a case that we have to switch.  

Switching to a single SHA-256 would mean that we lose the incremental checking which is actually very useful in the case of the failure mode to speed up failing.

Comment 3 Miloslav Trmač 2009-01-14 18:07:46 UTC
I suggested adding a single SHA-256 hash, not removing anything.

Or perhaps add a SHA-256 hash, SHA-256 fragment sums, and keep a single MD5 sum to allow mediacheck when booting from an older medium.

(But you're right, the justification to add this feature is pretty weak.)

Comment 4 Chris Lumens 2009-09-04 20:12:23 UTC
We will consider patches sent to anaconda-maint-list, but are unlikely to implement this on our own.

Comment 11 Tomasz Kłoczko 2018-01-26 23:25:19 UTC
Agree with Chris Lumens.
If someone will post the patch it can be integrated.
Closing.


Note You need to log in before you can comment on or make changes to this bug.