| … | |
… | |
| 25 | <tbody valign="top"> |
25 | <tbody valign="top"> |
| 26 | <tr class="field"><th class="field-name">GLEP:</th><td class="field-body">59</td> |
26 | <tr class="field"><th class="field-name">GLEP:</th><td class="field-body">59</td> |
| 27 | </tr> |
27 | </tr> |
| 28 | <tr class="field"><th class="field-name">Title:</th><td class="field-body">Manifest2 hash policies and security implications</td> |
28 | <tr class="field"><th class="field-name">Title:</th><td class="field-body">Manifest2 hash policies and security implications</td> |
| 29 | </tr> |
29 | </tr> |
| 30 | <tr class="field"><th class="field-name">Version:</th><td class="field-body">1.7</td> |
30 | <tr class="field"><th class="field-name">Version:</th><td class="field-body">1.9</td> |
| 31 | </tr> |
31 | </tr> |
| 32 | <tr class="field"><th class="field-name">Last-Modified:</th><td class="field-body"><a class="reference external" href="http://www.gentoo.org/cgi-bin/viewcvs.cgi/xml/htdocs/proj/en/glep/glep-0059.txt?cvsroot=gentoo">2010/02/02 05:49:27</a></td> |
32 | <tr class="field"><th class="field-name">Last-Modified:</th><td class="field-body"><a class="reference external" href="http://www.gentoo.org/cgi-bin/viewcvs.cgi/xml/htdocs/proj/en/glep/glep-0059.txt?cvsroot=gentoo">2010/04/07 21:34:24</a></td> |
| 33 | </tr> |
33 | </tr> |
| 34 | <tr class="field"><th class="field-name">Author:</th><td class="field-body">Robin Hugh Johnson <robbat2 at gentoo.org>,</td> |
34 | <tr class="field"><th class="field-name">Author:</th><td class="field-body">Robin Hugh Johnson <robbat2 at gentoo.org>,</td> |
| 35 | </tr> |
35 | </tr> |
| 36 | <tr class="field"><th class="field-name">Status:</th><td class="field-body">Draft</td> |
36 | <tr class="field"><th class="field-name">Status:</th><td class="field-body">Draft</td> |
| 37 | </tr> |
37 | </tr> |
| … | |
… | |
| 53 | </table> |
53 | </table> |
| 54 | <hr /> |
54 | <hr /> |
| 55 | <div class="contents topic" id="contents"> |
55 | <div class="contents topic" id="contents"> |
| 56 | <p class="topic-title first">Contents</p> |
56 | <p class="topic-title first">Contents</p> |
| 57 | <ul class="simple"> |
57 | <ul class="simple"> |
| 58 | <li><a class="reference internal" href="#abstract" id="id1">Abstract</a></li> |
58 | <li><a class="reference internal" href="#abstract" id="id2">Abstract</a></li> |
| 59 | <li><a class="reference internal" href="#motivation" id="id2">Motivation</a></li> |
59 | <li><a class="reference internal" href="#motivation" id="id3">Motivation</a></li> |
| 60 | <li><a class="reference internal" href="#specification" id="id3">Specification</a><ul> |
60 | <li><a class="reference internal" href="#specification" id="id4">Specification</a><ul> |
| 61 | <li><a class="reference internal" href="#the-bad-news" id="id4">The bad news</a></li> |
61 | <li><a class="reference internal" href="#the-bad-news" id="id5">The bad news</a></li> |
| 62 | <li><a class="reference internal" href="#how-fast-can-md5-be-broken" id="id5">How fast can MD5 be broken?</a></li> |
62 | <li><a class="reference internal" href="#how-fast-can-md5-be-broken" id="id6">How fast can MD5 be broken?</a></li> |
| 63 | <li><a class="reference internal" href="#the-good-news" id="id6">The good news</a></li> |
63 | <li><a class="reference internal" href="#the-good-news" id="id7">The good news</a></li> |
| 64 | <li><a class="reference internal" href="#what-should-be-done" id="id7">What should be done</a></li> |
64 | <li><a class="reference internal" href="#what-should-be-done" id="id8">What should be done</a></li> |
| 65 | <li><a class="reference internal" href="#checksum-depreciation-timing" id="id8">Checksum depreciation timing</a><ul> |
65 | <li><a class="reference internal" href="#checksum-depreciation-timing" id="id9">Checksum depreciation timing</a><ul> |
| 66 | <li><a class="reference internal" href="#general-principles" id="id9">General principles:</a></li> |
66 | <li><a class="reference internal" href="#general-principles" id="id10">General principles:</a></li> |
| 67 | <li><a class="reference internal" href="#immediate-plans" id="id10">Immediate plans:</a></li> |
67 | <li><a class="reference internal" href="#immediate-plans" id="id11">Immediate plans:</a></li> |
| 68 | </ul> |
68 | </ul> |
| 69 | </li> |
69 | </li> |
| 70 | </ul> |
70 | </ul> |
| 71 | </li> |
71 | </li> |
| 72 | <li><a class="reference internal" href="#backwards-compatibility" id="id11">Backwards Compatibility</a></li> |
72 | <li><a class="reference internal" href="#backwards-compatibility" id="id12">Backwards Compatibility</a></li> |
| 73 | <li><a class="reference internal" href="#references" id="id12">References</a></li> |
73 | <li><a class="reference internal" href="#references" id="id13">References</a></li> |
| 74 | <li><a class="reference internal" href="#thanks-to" id="id13">Thanks to</a></li> |
74 | <li><a class="reference internal" href="#thanks-to" id="id14">Thanks to</a></li> |
|
|
75 | <li><a class="reference internal" href="#id1" id="id15">References</a></li> |
| 75 | <li><a class="reference internal" href="#copyright" id="id14">Copyright</a></li> |
76 | <li><a class="reference internal" href="#copyright" id="id16">Copyright</a></li> |
| 76 | </ul> |
77 | </ul> |
| 77 | </div> |
78 | </div> |
| 78 | <div class="section" id="abstract"> |
79 | <div class="section" id="abstract"> |
| 79 | <h1><a class="toc-backref" href="#id1">Abstract</a></h1> |
80 | <h1><a class="toc-backref" href="#id2">Abstract</a></h1> |
| 80 | <p>While Manifest2 format allows multiple hashes, the question of which |
81 | <p>While Manifest2 format allows multiple hashes, the question of which |
| 81 | checksums should be present, why, and the security implications of such |
82 | checksums should be present, why, and the security implications of such |
| 82 | have never been resolved. This GLEP covers all of these issues, and |
83 | have never been resolved. This GLEP covers all of these issues, and |
| 83 | makes recommendations as to how to handle checksums both now, and in |
84 | makes recommendations as to how to handle checksums both now, and in |
| 84 | future.</p> |
85 | future.</p> |
| 85 | </div> |
86 | </div> |
| 86 | <div class="section" id="motivation"> |
87 | <div class="section" id="motivation"> |
| 87 | <h1><a class="toc-backref" href="#id2">Motivation</a></h1> |
88 | <h1><a class="toc-backref" href="#id3">Motivation</a></h1> |
| 88 | <p>This GLEP is being written as part of the work on signing the Portage |
89 | <p>This GLEP is being written as part of the work on signing the Portage |
| 89 | tree, but is only tangentially related to the actual signing of |
90 | tree, but is only tangentially related to the actual signing of |
| 90 | Manifests. Checksums present one possible weak point in the overall |
91 | Manifests. Checksums present one possible weak point in the overall |
| 91 | security of the tree - and a comprehensive security plan is needed.</p> |
92 | security of the tree - and a comprehensive security plan is needed.</p> |
| 92 | <p>This GLEP is not mandatory for the tree-signing specification, but |
93 | <p>This GLEP is not mandatory for the tree-signing specification, but |
| 93 | instead aims to improve the security of the hashes used in Manifest2. |
94 | instead aims to improve the security of the hashes used in Manifest2 |
| 94 | As such, it is also able to stand on it's own.</p> |
95 | [GLEP44]. As such, it is also able to stand on it's own.</p> |
| 95 | </div> |
96 | </div> |
| 96 | <div class="section" id="specification"> |
97 | <div class="section" id="specification"> |
| 97 | <h1><a class="toc-backref" href="#id3">Specification</a></h1> |
98 | <h1><a class="toc-backref" href="#id4">Specification</a></h1> |
| 98 | <div class="section" id="the-bad-news"> |
99 | <div class="section" id="the-bad-news"> |
| 99 | <h2><a class="toc-backref" href="#id4">The bad news</a></h2> |
100 | <h2><a class="toc-backref" href="#id5">The bad news</a></h2> |
| 100 | <p>First of all, I'd like to cover the bad news in checksum security. |
101 | <p>First of all, I'd like to cover the bad news in checksum security. |
| 101 | A much discussed point, as been the simple question: What is the |
102 | A much discussed point, as been the simple question: What is the |
| 102 | security of multiple independent checksums on the same data? |
103 | security of multiple independent checksums on the same data? |
| 103 | The most common position (and indeed the one previously held by myself), |
104 | The most common position (and indeed the one previously held by myself), |
| 104 | is that multiple checksums would be an increase in security, but we |
105 | is that multiple checksums would be an increase in security, but we |
| … | |
… | |
| 110 | checksum.</p> |
111 | checksum.</p> |
| 111 | <p>Wang et al [W04] extended Joux's [J04] work on SHA-0 to cover MD4, MD5, |
112 | <p>Wang et al [W04] extended Joux's [J04] work on SHA-0 to cover MD4, MD5, |
| 112 | HAVAL-128 and RIPEMD families of hashes.</p> |
113 | HAVAL-128 and RIPEMD families of hashes.</p> |
| 113 | </div> |
114 | </div> |
| 114 | <div class="section" id="how-fast-can-md5-be-broken"> |
115 | <div class="section" id="how-fast-can-md5-be-broken"> |
| 115 | <h2><a class="toc-backref" href="#id5">How fast can MD5 be broken?</a></h2> |
116 | <h2><a class="toc-backref" href="#id6">How fast can MD5 be broken?</a></h2> |
| 116 | <p>For a general collision, not a pre-image attack, since the announcement |
117 | <p>For a general collision, not a pre-image attack, since the announcement |
| 117 | by Wang et al [W04], the time required to break MD5 has been massively |
118 | by Wang et al [W04], the time required to break MD5 has been massively |
| 118 | reduced. Originally at 1 hour on a near-supercomputer (IBM P690) and |
119 | reduced. Originally at 1 hour on a near-supercomputer (IBM P690) and |
| 119 | estimated at 64 hours with a Pentium-3 1.7Ghz. This has gone down to |
120 | estimated at 64 hours with a Pentium-3 1.7Ghz. This has gone down to |
| 120 | less than in two years, to 17 seconds [K06a].</p> |
121 | less than in two years, to 17 seconds [K06a].</p> |
| … | |
… | |
| 136 | feasible, see [K06b] for an application that can produce two |
137 | feasible, see [K06b] for an application that can produce two |
| 137 | self-extracting EXE files, with identical MD5s, and whatever payload you |
138 | self-extracting EXE files, with identical MD5s, and whatever payload you |
| 138 | want.</p> |
139 | want.</p> |
| 139 | </div> |
140 | </div> |
| 140 | <div class="section" id="the-good-news"> |
141 | <div class="section" id="the-good-news"> |
| 141 | <h2><a class="toc-backref" href="#id6">The good news</a></h2> |
142 | <h2><a class="toc-backref" href="#id7">The good news</a></h2> |
| 142 | <p>Of the checksums presently used by Manifest2 (SHA1, SHA256, RIPEMD160), |
143 | <p>Of the checksums presently used by Manifest2 (SHA1, SHA256, RIPEMD160), |
| 143 | one stands close to being completely broken: SHA1; and another is |
144 | one stands close to being completely broken: SHA1; and another is |
| 144 | significantly weakened: RIPEMD160. The SHA2 series has suffered some |
145 | significantly weakened: RIPEMD160. The SHA2 series has suffered some |
| 145 | attacks, but still remains reasonably solid [G07],[K08].</p> |
146 | attacks, but still remains reasonably solid [G07],[K08].</p> |
| 146 | <p>To reduce the potential for future problems and any single checksum |
147 | <p>To reduce the potential for future problems and any single checksum |
| … | |
… | |
| 148 | strongest hash available from each family of checksums, and be prepared |
149 | strongest hash available from each family of checksums, and be prepared |
| 149 | to retire old checksums actively, unless there is a overriding reason to |
150 | to retire old checksums actively, unless there is a overriding reason to |
| 150 | keep a specific checksum, such as part of a migration plan.</p> |
151 | keep a specific checksum, such as part of a migration plan.</p> |
| 151 | </div> |
152 | </div> |
| 152 | <div class="section" id="what-should-be-done"> |
153 | <div class="section" id="what-should-be-done"> |
| 153 | <h2><a class="toc-backref" href="#id7">What should be done</a></h2> |
154 | <h2><a class="toc-backref" href="#id8">What should be done</a></h2> |
| 154 | <p>Portage should always try to verify all supported hashes that are |
155 | <p>Portage should always try to verify all supported hashes that are |
| 155 | available in a Manifest2, starting with the strongest ones as maintained |
156 | available in a Manifest2, starting with the strongest ones as maintained |
| 156 | by a preference list. Over time, the weaker checksums should be removed |
157 | by a preference list. Over time, the weaker checksums should be removed |
| 157 | from Manifest2 files, once all old Portage installations have had |
158 | from Manifest2 files, once all old Portage installations have had |
| 158 | sufficient time to upgrade. Stronger checksums shall be added as soon as |
159 | sufficient time to upgrade. Stronger checksums shall be added as soon as |
| … | |
… | |
| 169 | (python-mhash).</p> |
170 | (python-mhash).</p> |
| 170 | <p>The existence unsupported hash is not considered to be a failure unless |
171 | <p>The existence unsupported hash is not considered to be a failure unless |
| 171 | no supported hashes are available for a given Manifest entry.</p> |
172 | no supported hashes are available for a given Manifest entry.</p> |
| 172 | </div> |
173 | </div> |
| 173 | <div class="section" id="checksum-depreciation-timing"> |
174 | <div class="section" id="checksum-depreciation-timing"> |
| 174 | <h2><a class="toc-backref" href="#id8">Checksum depreciation timing</a></h2> |
175 | <h2><a class="toc-backref" href="#id9">Checksum depreciation timing</a></h2> |
| 175 | <div class="section" id="general-principles"> |
176 | <div class="section" id="general-principles"> |
| 176 | <h3><a class="toc-backref" href="#id9">General principles:</a></h3> |
177 | <h3><a class="toc-backref" href="#id10">General principles:</a></h3> |
| 177 | <p>A minimum set of depreciated checksums shall be maintained only to |
178 | <p>A minimum set of depreciated checksums shall be maintained only to |
| 178 | support old package manager versions where needed by historically used |
179 | support old package manager versions where needed by historically used |
| 179 | trees:</p> |
180 | trees:</p> |
| 180 | <ul class="simple"> |
181 | <ul class="simple"> |
| 181 | <li>New package manager versions should NOT use depreciated checksums in</li> |
182 | <li>New package manager versions should NOT use depreciated checksums in</li> |
| … | |
… | |
| 185 | <li>Removal of depreciated checksums shall happen after no less than 18 |
186 | <li>Removal of depreciated checksums shall happen after no less than 18 |
| 186 | months or one major Portage version cycle, whichever is greater.</li> |
187 | months or one major Portage version cycle, whichever is greater.</li> |
| 187 | </ul> |
188 | </ul> |
| 188 | </div> |
189 | </div> |
| 189 | <div class="section" id="immediate-plans"> |
190 | <div class="section" id="immediate-plans"> |
| 190 | <h3><a class="toc-backref" href="#id10">Immediate plans:</a></h3> |
191 | <h3><a class="toc-backref" href="#id11">Immediate plans:</a></h3> |
| 191 | <p>For the current Portage, both SHA1 and RIPEMD160 should be immediately |
192 | <p>For the current Portage, both SHA1 and RIPEMD160 should be immediately |
| 192 | removed, as they present no advantages over the already present SHA256. |
193 | removed, as they present no advantages over the already present SHA256. |
| 193 | SHA256 cannot be replaced immediately with SHA512, as existing Portage |
194 | SHA256 cannot be replaced immediately with SHA512, as existing Portage |
| 194 | versions need at least one supported algorithm present (SHA256 support |
195 | versions need at least one supported algorithm present (SHA256 support |
| 195 | was added in June 2006), so it must be retained for some while.</p> |
196 | was added in June 2006), so it must be retained for some while.</p> |
| … | |
… | |
| 204 | </ul> |
205 | </ul> |
| 205 | </div> |
206 | </div> |
| 206 | </div> |
207 | </div> |
| 207 | </div> |
208 | </div> |
| 208 | <div class="section" id="backwards-compatibility"> |
209 | <div class="section" id="backwards-compatibility"> |
| 209 | <h1><a class="toc-backref" href="#id11">Backwards Compatibility</a></h1> |
210 | <h1><a class="toc-backref" href="#id12">Backwards Compatibility</a></h1> |
| 210 | <p>Old versions of Portage may support and expect only specific checksums. |
211 | <p>Old versions of Portage may support and expect only specific checksums. |
| 211 | This is accounted for in the checksum depreciation discussion.</p> |
212 | This is accounted for in the checksum depreciation discussion.</p> |
| 212 | <p>For maximum compatiability, we should only have to include each of the |
213 | <p>For maximum compatiability, we should only have to include each of the |
| 213 | old algorithms that we are officially still supporting, as well as the |
214 | old algorithms that we are officially still supporting, as well as the |
| 214 | new ones that we prefer.</p> |
215 | new ones that we prefer.</p> |
| 215 | </div> |
216 | </div> |
| 216 | <div class="section" id="references"> |
217 | <div class="section" id="references"> |
| 217 | <h1><a class="toc-backref" href="#id12">References</a></h1> |
218 | <h1><a class="toc-backref" href="#id13">References</a></h1> |
| 218 | <dl class="docutils"> |
219 | <dl class="docutils"> |
| 219 | <dt>[AHS] NIST (2007). "NIST's Plan for New Cryptographic Hash Functions",</dt> |
220 | <dt>[AHS] NIST (2007). "NIST's Plan for New Cryptographic Hash Functions",</dt> |
| 220 | <dd>(Advanced Hash Standard). <a class="reference external" href="http://csrc.nist.gov/pki/HashWorkshop/">http://csrc.nist.gov/pki/HashWorkshop/</a></dd> |
221 | <dd>(Advanced Hash Standard). <a class="reference external" href="http://csrc.nist.gov/pki/HashWorkshop/">http://csrc.nist.gov/pki/HashWorkshop/</a></dd> |
| 221 | <dt>[BOBO06] Boneh, D. and Boyen, X. (2006). "On the Impossibility of</dt> |
222 | <dt>[BOBO06] Boneh, D. and Boyen, X. (2006). "On the Impossibility of</dt> |
| 222 | <dd>Efficiently Combining Collision Resistant Hash Functions"; Proceedings |
223 | <dd>Efficiently Combining Collision Resistant Hash Functions"; Proceedings |
| … | |
… | |
| 250 | version (August 17, 2004). Available online from: |
251 | version (August 17, 2004). Available online from: |
| 251 | <a class="reference external" href="http://eprint.iacr.org/2004/199.pdf">http://eprint.iacr.org/2004/199.pdf</a></dd> |
252 | <a class="reference external" href="http://eprint.iacr.org/2004/199.pdf">http://eprint.iacr.org/2004/199.pdf</a></dd> |
| 252 | </dl> |
253 | </dl> |
| 253 | </div> |
254 | </div> |
| 254 | <div class="section" id="thanks-to"> |
255 | <div class="section" id="thanks-to"> |
| 255 | <h1><a class="toc-backref" href="#id13">Thanks to</a></h1> |
256 | <h1><a class="toc-backref" href="#id14">Thanks to</a></h1> |
| 256 | <dl class="docutils"> |
257 | <dl class="docutils"> |
| 257 | <dt>I'd like to thank the following folks, in no specific order:</dt> |
258 | <dt>I'd like to thank the following folks, in no specific order:</dt> |
| 258 | <dd><ul class="first last simple"> |
259 | <dd><ul class="first last simple"> |
| 259 | <li>Ciaran McCreesh (ciaranm) - for pointing out the Joux (2004) paper, |
260 | <li>Ciaran McCreesh (ciaranm) - for pointing out the Joux (2004) paper, |
| 260 | and also being stubborn enough in not accepting a partial solution.</li> |
261 | and also being stubborn enough in not accepting a partial solution.</li> |
| … | |
… | |
| 263 | codebase.</li> |
264 | codebase.</li> |
| 264 | </ul> |
265 | </ul> |
| 265 | </dd> |
266 | </dd> |
| 266 | </dl> |
267 | </dl> |
| 267 | </div> |
268 | </div> |
|
|
269 | <div class="section" id="id1"> |
|
|
270 | <h1><a class="toc-backref" href="#id15">References</a></h1> |
|
|
271 | <table class="docutils citation" frame="void" id="glep44" rules="none"> |
|
|
272 | <colgroup><col class="label" /><col /></colgroup> |
|
|
273 | <tbody valign="top"> |
|
|
274 | <tr><td class="label">[GLEP44]</td><td>Mauch, M. (2005) GLEP44 - Manifest2 format. |
|
|
275 | <a class="reference external" href="http://www.gentoo.org/proj/en/glep/glep-0044.html">http://www.gentoo.org/proj/en/glep/glep-0044.html</a></td></tr> |
|
|
276 | </tbody> |
|
|
277 | </table> |
|
|
278 | </div> |
| 268 | <div class="section" id="copyright"> |
279 | <div class="section" id="copyright"> |
| 269 | <h1><a class="toc-backref" href="#id14">Copyright</a></h1> |
280 | <h1><a class="toc-backref" href="#id16">Copyright</a></h1> |
| 270 | <p>Copyright (c) 2006-2010 by Robin Hugh Johnson. This material may be |
281 | <p>Copyright (c) 2006-2010 by Robin Hugh Johnson. This material may be |
| 271 | distributed only subject to the terms and conditions set forth in the |
282 | distributed only subject to the terms and conditions set forth in the |
| 272 | Open Publication License, v1.0.</p> |
283 | Open Publication License, v1.0.</p> |
| 273 | <p>vim: tw=72 ts=2 expandtab:</p> |
284 | <!-- vim: tw=72 ts=2 expandtab: --> |
| 274 | </div> |
285 | </div> |
| 275 | |
286 | |
| 276 | </div> |
287 | </div> |
| 277 | <div class="footer"> |
288 | <div class="footer"> |
| 278 | <hr class="footer" /> |
289 | <hr class="footer" /> |
| 279 | <a class="reference external" href="glep-0059.txt">View document source</a>. |
290 | <a class="reference external" href="glep-0059.txt">View document source</a>. |
| 280 | Generated on: 2010-02-07 10:37 UTC. |
291 | Generated on: 2010-04-07 21:54 UTC. |
| 281 | Generated by <a class="reference external" href="http://docutils.sourceforge.net/">Docutils</a> from <a class="reference external" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> source. |
292 | Generated by <a class="reference external" href="http://docutils.sourceforge.net/">Docutils</a> from <a class="reference external" href="http://docutils.sourceforge.net/rst.html">reStructuredText</a> source. |
| 282 | |
293 | |
| 283 | </div> |
294 | </div> |
| 284 | </body> |
295 | </body> |
| 285 | </html> |
296 | </html> |
Parent Directory
| 
Revision Log
| 
Patch