Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #164601
| From | Nicolas George <george@nsup.org> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System |
| Date | 2016-02-24 11:00 +0100 |
| Message-ID | <r5EoG-2C6-5@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <r5ne9-7n1-7@gated-at.bofh.it> <r5nxv-7tJ-11@gated-at.bofh.it> <r5pJ0-G1-7@gated-at.bofh.it> <r5qlI-WQ-21@gated-at.bofh.it> <r5qYp-1u4-1@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
Le quintidi 5 ventôse, an CCXXIV, Christian Seiler a écrit :
> But if you say what Debian is doing is a mistake, then this _is_ what
> you are talking about.
I am quite sure of what I am talking about and what I am not talking about.
> This is decisively not true when we are talking about signing files. If
> you look at RFC 4880 [1], if you sign a normal file ("binary document",
> type 0x00), what is signed with the asymmetric algorithm is [2]:
>
> asym_input = H(contents || trailer)
>
> In OpenPGP v4, the trailer is given by [3]
>
> trailer = 0x04 || sigtype || pkalg || hashalg || hsplen || hspdata
> sigtype = 0x00 (binary document)
> pkgalg = public key algorithm, e.g. 0x01 (RSA)
> hashalg = hash algorithm, e.g. 0x08 (SHA256)
>
> hsplen: two octets denoting the length of hspdata (may be 0)
> hspdata: subpackets, containing e.g. signature date and time
>
> So a valid way to construct an OpenPGP v4 signature would be to
> use
>
> H(contents || 0x04 0x00 0x01 0x08 0x00 0x00)
>
> as the input for the RSA algorithm (and then pack that up in a
> nice OpenPGP packet).
I did not have the reference of what OpenPGP does near at hand, I was more
referring to the way hashes are used to build HMACs:
H(K^opad || H((K^ipad) || message))
As you can see, choosing the message does not leave you enough freedom to
exploit a collision.
> Furthermore, what you are saying doesn't make much sense: even if
> you add some random nonce (maybe in a subpacket, which at least
> GnuPG doesn't appear to do), what does that protect against?
>
> If you have a signature by a given key, and you have a feasible
> preimage attack against the hash algorithm used in that specific
> signature, you only need to find a preimage collision against your
> chosen file contents concatenated with the trailer used in that
> specific signature. Since _any_ preimage attack needs to deal with
> prefixes and suffixes anyway (file formats that are processed have
> certain things that need to exist in the right places for programs
> processing these files to accept them), I don't see how that makes
> this any more difficult.
>
> Basically: if there's a preimage attack against a hash, you are
> able to forge OpenPGP signatures on files using that hash function
> in the same way as you are able to break a simple hash.
Between a hash that has no known attacks and a full working preimage attack,
there is a lot of space for limited collision attacks. Even if it does not
apply to the simplified example I gave, a well crafted protocol will be able
to mitigate some of these attacks. Not all, not perfectly, but still some,
and that is better than nothing.
> Actually, scrambling passwords is more complicated than what you
> describe
I did not describe how to scramble passwords, I just explained why one side
of the process was necessary. The requirement of expensive computations
exists too, but it is irrelevant for the current discussion.
Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Warning �~@~T Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System) Karen Lewellen <klewellen@shellworld.net> - 2016-02-22 19:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-22 20:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Karen Lewellen <klewellen@shellworld.net> - 2016-02-22 20:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-22 21:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Charlie Kravetz <cjk@teamcharliesangels.com> - 2016-02-22 22:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Stuart Longland <stuartl@longlandclan.id.au> - 2016-02-25 03:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Dalios <dalios@eumx.net> - 2016-02-22 23:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-22 23:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Sven Hartge <sven@svenhartge.de> - 2016-02-22 23:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 00:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-02-24 10:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-24 13:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System <tomas@tuxteam.de> - 2016-02-24 14:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-02-24 14:20 +0100
OT: ownership of Mega.co.nz (was Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System) Jonathan Dowland <jmtd@debian.org> - 2016-02-24 15:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Gener Badenas <gener.ong.badenas@gmail.com> - 2016-02-23 02:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Glenn English <ghe@srv.slsware.net> - 2016-02-23 05:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 08:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Darac Marjal <mailinglist@darac.org.uk> - 2016-02-23 11:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 11:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 12:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 12:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 13:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 13:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System David Wright <deblis@lionunicorn.co.uk> - 2016-02-23 16:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 16:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System David Wright <deblis@lionunicorn.co.uk> - 2016-02-23 17:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 17:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System arian <debian@semioptimal.net> - 2016-02-23 17:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System arian <debian@semioptimal.net> - 2016-02-23 17:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 18:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System arian <debian@semioptimal.net> - 2016-02-23 18:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System David Wright <deblis@lionunicorn.co.uk> - 2016-02-23 21:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-24 11:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System David Wright <deblis@lionunicorn.co.uk> - 2016-02-27 06:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Henrique de Moraes Holschuh <hmh@debian.org> - 2016-02-25 15:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Stefan Monnier <monnier@iro.umontreal.ca> - 2016-02-25 15:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Stefan Monnier <monnier@iro.umontreal.ca> - 2016-02-25 15:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Christian Seiler <christian@iwakd.de> - 2016-02-25 16:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-25 21:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 16:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 17:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 17:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 18:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Christian Seiler <christian@iwakd.de> - 2016-02-23 19:20 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 20:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Christian Seiler <christian@iwakd.de> - 2016-02-23 20:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-24 11:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Christian Seiler <christian@iwakd.de> - 2016-02-24 12:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-24 13:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Christian Seiler <christian@iwakd.de> - 2016-02-24 15:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Richard Hector <richard@walnut.gen.nz> - 2016-02-24 10:50 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-24 11:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Richard Hector <richard@walnut.gen.nz> - 2016-02-24 11:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Seeker <seeker5528@comcast.net> - 2016-02-23 17:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 17:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System jdd <jdd@dodin.org> - 2016-02-23 12:10 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 12:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Nicolas George <george@nsup.org> - 2016-02-23 13:30 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Andrew M.A. Cater" <amacater@galactic.demon.co.uk> - 2016-02-23 13:00 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2016-02-24 10:40 +0100
Re: Warning Linux Mint Website Hacked and ISOs replaced with Backdoored Operating System "Thomas Schmitt" <scdbackup@gmx.net> - 2016-02-23 11:50 +0100
csiph-web