From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 38190 invoked by alias); 26 Oct 2015 18:09:00 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 38182 invoked by uid 89); 26 Oct 2015 18:08:59 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=1.2 required=5.0 tests=AWL,BAYES_50,KAM_LAZY_DOMAIN_SECURITY,RP_MATCHES_RCVD autolearn=no version=3.3.2 X-HELO: etr-usa.com Received: from etr-usa.com (HELO etr-usa.com) (130.94.180.135) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Mon, 26 Oct 2015 18:08:58 +0000 Received: (qmail 73523 invoked by uid 13447); 26 Oct 2015 18:08:57 -0000 Received: from unknown (HELO polypore.west.etr-usa.com) ([73.26.17.49]) (envelope-sender ) by 130.94.180.135 (qmail-ldap-1.03) with AES256-SHA encrypted SMTP for ; 26 Oct 2015 18:08:57 -0000 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 8.2 \(2104\)) Subject: MD5 vs SHA512 in setup.ini (was: Why package cache is not used during setup download?) From: Warren Young In-Reply-To: <190443388.20151026144831@yandex.ru> Date: Mon, 26 Oct 2015 23:37:00 -0000 Content-Transfer-Encoding: quoted-printable Message-Id: <140F1DEE-6492-4F29-9185-9DC4D546B50F@etr-usa.com> References: <133366775.20151025170018@yandex.ru> <190443388.20151026144831@yandex.ru> To: cygwin@cygwin.com X-IsSubscribed: yes X-SW-Source: 2015-10/txt/msg00467.txt.bz2 On Oct 26, 2015, at 5:48 AM, Andrey Repin wrote: >=20 > MD5 hash proven weak That=E2=80=99s a bit strong. It=E2=80=99s better to say that MD5 has weak = collision resistance properties, which in this context means it is possible= to generate a Cygwin package with arbitrary contents that produces the sam= e hash as the legitimate package, in a computationally useful time frame. But, that is not the value MD5 is providing to setup.exe. If you are downl= oading a package from bad-actor.com, you are also downloading setup.ini fro= m there, so they can rewrite the hashes. Only if you take the extra step t= o get your setup.ini from a different site can you cross-check the hashes. Even then, all it proves is that the file you downloaded is the one the ser= ver claims to be providing. It doesn=E2=80=99t prove provenance, which is = what people really seem to want, when they go hand-checking hashes. One way to solve that would be for cygwin.com could run a special-purpose C= A, and for the process that moves uploaded packages into the distribution d= irectory to sign them using the CA=E2=80=99s private key. Then setup.exe c= an cryptographically prove to itself that it is installing legitimate packa= ges. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple