Re: [Gnu-arch-users] Re: HEADS UP: checksums change is not backward compatible

[Andrew Suffield]

On Fri, Jan 16, 2004 at 02:25:19PM +1100, Robert Collins wrote:
> On Fri, 2004-01-16 at 12:01, Tom Lord wrote:
> 
> > 
> > It shouldn't be difficult to modify these changes so that, for the
> > moment, they will generate _both_ md5 and sha1 checksums.   That can
> > be done in a way that will preserve upward compatability.
> 
> Done (both md5 and sha1), but it cannot. the 1.1pre0 parser is bust, and
> fails.
> 
> Best practice AIUI is to do both anyway, so I don't see that changing.

It's certainly cryptographically stronger to keep and verify both;
that way both algorithms would have to be broken in order to defeat
the system (in the event of an effective attack against either, the
system remains reasonably strong).

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ |
 `. `'                          |
   `-             -><-          |

signature.asc
Description: Digital signature