md5

[Pinback]

hi, i'm new here.

Just downloaded my first file and wanted to verify it.
So i looked for the md5 ... and couldn't find it!
So i searched and found that someone else had asked the question in 2009.
The answer given was:

Fedora doesn't use MD5 checksums any more because of the weaknesses found in the algorithm

Am i not right in saying that it was only a theoretical weakness that was found?
And that this "weakness" is still more than 10 times less likely than a DNA match?

[bob]

Um, since we're not Fedora Project, just a private Forum for working with Fedora, you really want to address any changes to Bugzilla (check the Fedora Project link above for info) the Project's request line. Meanwhile, sha256 is the method that Fedora now uses.

As to the hypothetical question involved, that really needs to be in Wibble, since it's really not about Fedora, just about the MD5 issue. I'll move it there.

BTW, from the FedoraProject site, here's their explanation on F14:

Verify Fedora

Fedora does not publish MD5 or SHA1 hashes to verify images since they are not secure enough. Instead we have been using SHA256 since Fedora 11. In Linux, you can use sha256sum command (part of coreutils and installed by default) to verify the Fedora image

[Pinback]

Cheers for moving the post bob.
I wasn't intending to "report" it, i simply wanted to start a chat about it.
What do others think about it's "lack of security".
Maybe with the hope that there might be a cryptologist on the forum ...

[RupertPupkin]

So you're asking why Fedora would choose to use a more secure algorithm instead of a weaker one?

[pete_1967]

http://en.wikipedia.org/wiki/MD5
http://www.win.tue.nl/hashclash/rogue-ca/
http://blog.mozilla.org/security/200...icate-forgery/
http://www.sslshopper.com/article-md...e-created.html
http://www.perlmonks.org/?node_id=386193

Enough reasons not to use MD5 for starters?

[Pinback]

1)
as i said, i thought that it was only a theoretical issue but clearly it is not
"group of researchers described how to create a pair of files that share the same MD5 checksum"

2)
my plan was to simply start a chat about this issue.

thanks for your replies