Hi, i wrote: > > The ISO checksums are provided more for transport verification than > > for the fight against intentional mainpulation.
Nicolas George wrote: > If that were true, CRC32 would be enough. For detecting most glitches, yes. But not if we want to use it for identifying files in benevolent environments. The birthday paradox predicts that CRC32 will produce the first collision after square root of 32 bit, i.e. 16 bit = 65536 tries. MD5 gets square rooted to 64 bit, which gives a collision roughly the same probability as that a 10 km asteroid hits you (not me) directly within a day. Assumed that such a thing happens every 100 million years. (And well, who would respect a person that divides polynomials on a Galois field.) > Signing hashes will get you a spanking from any cryptographer. I sign my release tarballs by a gpg command which i really don't understand, except that Karl Berry of FSF teached me to use it for GNU uploads. (How many bits worth is Karl's reputation and my illusion that it was him who wrote to me ?) I wonder whether there are performance reasons why only the hashs of Debian ISOs are PGP signed. Have a nice day :) Thomas
