On 5/4/07, John Fiore <[EMAIL PROTECTED]> wrote:
Your point is taken, however, can you illustrate the threat against which the stronger hash is to protect? If the threat is that someone will redirect you to a fake openbsd.org (through DNS cache poisoning, etc.), the stronger hash offers no protection. If there's a man in the middle, it similarly offers you no more protection, and the same is true if someone manages to hack openbsd.org and upload different binaries.
You are completely correct. A stronger hash will do nothing against such an attack. However, my argument was that since attacks on MD5 will just be easier as cryptanalytic techniques improve and CPU time becomes cheaper, it makes no sense to keep using it when stronger hashes are available.
