Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 18 Sep 2014 12:30:22 +1000
From: Michael Samuel <>
Subject: Re: Re: [CVE Requests] rsync and librsync collisions

Ok, for rsync you can download colliding blocks (and a brief description) here:

I don't get the feeling that this will be fixed upstream, but a simple
fix would be
to incorporate libdetectcoll from Marc Stevens into rsync, and when a collision
attempt is detected to simply send a data block.

A longer-term would be to just replace MD5 with a collision-resistant hash
function - blake2 is a good fit.  The 128-bit output is right on the
edge of being
strong enough.

I submitted a very rough patch which does both, but I haven't had the
time to clean
the rough edges - the libdetectcoll codebase needs a fair amount of cleaning
(printfs etc), and the rsync codebase needs a fair bit of refactor to
handle hash
output lengths > 16 bytes.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.