Hi, Marius Vollmer <[EMAIL PROTECTED]> writes:
> Well, they get to choose both texts that have a MD5 collision. > Looking at the PostScript source reveals that the texts have been > rigged, which should be enough if this goes to court. In our case, an > attacker would need to find a second meaningful text that collides > with the text that we provide. I guess that is much harder to do. Well, since *you* are malicious, you could very well have prepared a second tarball whose MD5 is the same and which you will propagate during the days following the announcement. ;-) Seriously, this kind of attack is really about the level of trust one can have in the *emitter* of the tarball and checksum. > And the tarball is signed with a SHA1 hash anyway. Maybe I should > include the signature in the announcement and not a checksum... Right. Thanks, Ludovic. _______________________________________________ Guile-devel mailing list Guile-devel@gnu.org http://lists.gnu.org/mailman/listinfo/guile-devel
