Re: [Gnu-arch-users] crypto features and 1.2preX

[Brian May]

>>>>> "Brian" == Brian May <address@hidden> writes:

>>>>> "Tom" == Tom Lord <address@hidden> writes:

    Tom> When arch retrieves a file from an archive, it computes an
    Tom> MD5 of the file it receives and compares that to the checksum
    Tom> file.  If they disagree, an error is signaled and the
    Tom> operation is aborted.

    Brian> 1. I have heard, from other mailing lists, that it is
    Brian> feasible to alter a file *and* *its* length* in such a way
    Brian> that it will produce exactly the same MD5 Checksum. The
    Brian> moral of the story was you can't rely on the MD5 checksum
    Brian> by itself, you need the MD5Sum + Length of the data.

    Brian> Does arch do the right thing here?

When I wrote this message, I hadn't noticed the thread "SHA1 sums for
checksums file"; Colin Watson already raised the same issue (with
references). Sorry about the extra noise generated.
-- 
Brian May <address@hidden>