Upgrade the embedded checksum from MD5 to SHA256?

[Roland Clobus]

Hello list,

In the Debian-installer main menu the entry 'Check the integrity of
installation media' verifies whether the currently booted image is
untampered (package=cdrom-checker).

It reads the file 'md5sum.txt' and verifies all files listed there [1].
In live-build we provide sha256sum.txt since 2020-03-18, since MD5
checksums are known to be insecure.

There are good instructions on the download pages [2] that help with
verification of the downloaded ISO file using sha256 and sha512, but the
verification on a booted medium uses only md5.

Could/Should the checksum file be upgrade to use sha256 instead of md5?
I could provide a MR if desired.

The cost: 32 additional bytes per file. (With currently about 1200 files
that would be 38KiB)

With kind regards,
Roland Clobus

[1] https://sources.debian.org/src/cdrom-checker/1.65/main.c/#L115
[2] https://get.debian.org/images/weekly-live-builds/amd64/iso-hybrid/

[Steve McIntyre]

Hey Roland!

Post by Roland Clobus
In the Debian-installer main menu the entry 'Check the integrity of
installation media' verifies whether the currently booted image is untampered
(package=cdrom-checker).
It reads the file 'md5sum.txt' and verifies all files listed there [1].
In live-build we provide sha256sum.txt since 2020-03-18, since MD5 checksums
are known to be insecure.
There are good instructions on the download pages [2] that help with
verification of the downloaded ISO file using sha256 and sha512, but the
verification on a booted medium uses only md5.

That's fine IMHO: at this point, the checksum is for verifying media
corruption rather than tampering. md5 is fine for that. We tell people
how to verify an image download using stronger checksum, as that's the
place that's likely to be attacked.

Post by Roland Clobus
Could/Should the checksum file be upgrade to use sha256 instead of md5? I
could provide a MR if desired.
The cost: 32 additional bytes per file. (With currently about 1200 files that
would be 38KiB)

I don't think this matters, tbh. Any other opinions?

[Cyril Brulebois]

Post by Steve McIntyre
That's fine IMHO: at this point, the checksum is for verifying media
corruption rather than tampering. md5 is fine for that. We tell people
how to verify an image download using stronger checksum, as that's the
place that's likely to be attacked.

Yes, that's the same kind of benefit we get from having md5sums shipped
in deb files?

Post by Steve McIntyre
I don't think this matters, tbh. Any other opinions?

The status quo looks fine to me, switching does not seem crazy either
(modulo making sure data shipped vs. code using it get with a suitable
timing and/or with some fallback code, I didn't look into the details).


Cheers,