Report of collision-generation with MD5

[Mike Tancsa]

At 01:58 PM 18/08/2004, Peter C. Lai wrote:
>Well while collisions are cryptographically significant, they don't
>necessarily impact any operational security of the the hash. (Since the
>collision merely means that there are possibly two inputs which will hash to
>the same digest).


As I have no crypto background to evaluate some of the (potentially wild 
and erroneous) claims being made in the popular press* (eg 
http://news.com.com/2100-1002_3-5313655.html see quote below), one thing 
that comes to mind is the safety of ports.  If someone can pad an archive 
to come up with the same MD5 hash, this would challenge the security of the 
FreeBSD ports system no ?

* "MD5's flaws that have been identified in the past few days mean that an 
attacker can generate one hash collision in a few hours on a standard PC. 
To write a specific back door and cloak it with the same hash collision may 
be much more time intensive. "

         ---Mike