Features/StrongerHashes

Support and use hashes stronger than SHA-1

Summary

Support stronger hashes than MD5 and SHA-1 (focusing on SHA-2 in particular, but making it easy to migrate to other hashes in the future), and use them by default where appropriate.

Owner

• Name: Mitr
• Email: mitr@redhat.com

Current status

• Targeted release: Fedora 11
• Last updated: 2008-12-17
• Percentage of completion: 15%

Detailed Description

The widely-used MD5 and SHA-1 hashes have known vulnerabilities ([1], [2]). These vulnerabilities are do not break the hashes completely, but it is prudent to migrate to stronger hashes (e.g. the SHA-2 family) as soon as possible (see for example the tables in [[3]]).

As many packages as possible will have SHA-2 hash support added, focusing on the most widely used and most security sensitive packages first. If it does not significantly affect interoperability, these hashes will be used by default.

Of particular interest is the RPM file format: The file format now has support for using stronger hashes in package signatures and payload file hashes (see RPM_file_format_changes_to_support_SHA-256), but it is not enabled by default. There are some interoperability issues when RPM packages using more than one hash type are used together (affecting updates of %config files that don't change their contents, and sharing identical files across packages that use different hashes - see [[4]] for specifics). Tools that work with RPMs (e.g. koji) need to support the RPM file format extensions.

Another important area is hashes used in repodata, repodata signatures, package signatures, and release signatures (the signed SHA1SUM file).

Not all uses of hashes are security relevant and need to be converted. For example, these uses can be vulnerable to attacks on hash algorithms:

• Digital signatures
• Other uses of hashes to verify authenticity of data (e.g. the digitally signed SHA1SUM file that contains hashes of other files)
• Password encryption (/etc/shadow already uses SHA-2 in Fedora 10, but application-specific password stores often don't.)

These uses should be converted to better ensure integrity of important data:

• Detection of data corruption

These uses are probably not at risk:

• Combining data from various unpredictable sources into a few random bytes

Benefit to Fedora

A system more resistant to attacks on the hashes. This will also make it possible to build an operating system based on Fedora that will be certifiable for government use ([5]).

Drawbacks

(yum upgrade) from Fedora 9 directly to Fedora 11 won't be possible (the necessary rpm backport would be too large). Upgrade from Fedora 9 to 10, then to 11, should work. Alternatively, a repo that provides the Fedora 11 rpm recompiled for F-9 can be provided (unsupported just like using yum to upgrade).

Upgrades from RPM packages that use MD5 to packages that use SHA-2 (e.g. upgrade from F<11 to F11) will move all user-modified %config (not %config(noreplace)) files to .rpmsave.

Scope

For RPM file hashes: RPM, koji, spacewalk.

For repodata/release hashes and signatures: yum, createrepo, pungi.

At least one file copying tool and one backup tool need to support SHA-256: scp and bacula appear to do so.

As many other individual packages that use hashes as possible.

How To Test

• Where changes in packages are local, test the packages one by one.
• Enable SHA-2 hashes in RPM, build RPMs that use them. Test various scenarios of systems that combine packages that use SHA-2 hashes and MD5 hashes (file conflicts and %config file handling in particular).

User Experience

• No user action is necessary to continue to be able to use Fedora.
• Users that require use of strong hashes at the cost of interoperability might have to configure some applications manually to use the strong hashes.
• RPM files generated on Fedora using the Fedora configuration (probably in redhat-rpm-config) will not be installable on systems with older versions of RPM by default; RPM macro definitions will be necessary to build backward-compatible RPMs

Dependencies

None

Contingency Plan

• For isolated packages, revert the specific package.
• For RPM file format, revert the RPM configuration change and rebuild affected packages.

Documentation

None yet. Tracking bug #461972 [6].

Release Notes

(In the installation section): Upgrades from Fedora 9 directly to Fedora 11 using (yum upgrade) don't work. You can use preupgrade, or upgrade in two steps: first to Fedora 10, then to Fedora 11. See [reference to the other release note] for more information.

(In the new features section):

SHA-256 support

Fedora now uses the SHA-256 digest algorithm for data verification and authentication in more places than before, migrating from the weaker SHA-1 and MD-5 algorithms. Where possible, the migration was transparent; in other places the default configuration was changed or manual configuration is necessary to use the stronger algorithms.

• createrepo now uses SHA-256 by default. Use the -s sha1 option to generate SHA-1 again.
• File information inside Fedora 11 RPM packages uses SHA-256. RPM versions from Fedora 9 and older distributions cannot install such packages. If redhat-rpm-config is installed, any built RPM packages will use SHA-256 as well unless the _source_filedigest_algorithm and _binary_filedigest_algorithm RPM macros are defined with the value 1.

• To use a SHA-1 HMAC with ssh and related programs, define the MACs=hmac-sha1 option on the command line or your configuration file.

Comments and Discussion

• See Talk:Features/StrongerHashes

---