Hacker News Reader

Comment by mcpherrinm | Hacker News Reader

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about.

SHA1/2 at least, but preferably a gpg signature would be much better.

View on HN

In the comments section...

"You can find them at http://ftp.heanet.ie/pub/linuxmint.com/stable/17.3/ also along with signed sha256sums."

Yes, but why mention MD5 by default? Most machines that have md5sum installed also have sha1sum/sha256sum.

>It's pretty trivial to collide MD5

... collisions=/=second-preimage attacks

>SHA1/2 at least, but preferably a gpg signature would be much better.

SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.

I think I understand you, but I think you could be a bit more explicit in your assertion.

I think you're saying MD5 is still a decent checksum for non-cryptographic purposes. Without a cryptographic signature or other authenticated integrity-checked distribution channel, there's very little advantage of using a cryptographic checksum.

The relevant thing here is that the main weakness in MD5 requires both the "good" and "evil" versions of the message (or file) to be produced by the same party. It doesn't allow J. Random Attacker to swoop in and alter things that already exist. However, it would allow a hypothetical Evil Maintainer to pre-cook "good" and "evil" versions and swap between them without changing the MD5.

How do you get hit by file corruption when downloading via TCP in 2016? I don't recall this ever happening to me.

While possible, it's really really unlikely for this to happen without some fairly serious network issues between you and whoever you're downloading from.

Or a flaky bit in the RAM or (very rarely) storage media.

Use a Canadian ISP.

"The TCP checksum uses the same mathematical function as is used by other Internet protocols (UDP, ICMP, etc.). For large data transfers, there is some concern that this checksum is not really strong enough [SP00], so careful applications should apply their own error protection methods (e.g., stronger checksums or CRCs) or use a middleware layer to achieve the same result (e.g., see [RFC5044])."

-- TCP/IP Illustrated

TCP checksums are not reliable

When talking about specific files the attacker used in the past, MD5 is good enough to show it's not those.

Reply on news.ycombinator.com