Return-Path: 
 <solr-dev-return-1694-apmail-lucene-solr-dev-archive=lucene.apache.org@lucene.apache.org>
Delivered-To: apmail-lucene-solr-dev-archive@locus.apache.org
Received: (qmail 97902 invoked from network); 8 Dec 2006 22:43:45 -0000
Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.2)
  by minotaur.apache.org with SMTP; 8 Dec 2006 22:43:45 -0000
Received: (qmail 77967 invoked by uid 500); 8 Dec 2006 22:43:53 -0000
Delivered-To: apmail-lucene-solr-dev-archive@lucene.apache.org
Received: (qmail 77943 invoked by uid 500); 8 Dec 2006 22:43:52 -0000
Mailing-List: contact solr-dev-help@lucene.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:solr-dev-help@lucene.apache.org>
List-Unsubscribe: <mailto:solr-dev-unsubscribe@lucene.apache.org>
List-Post: <mailto:solr-dev@lucene.apache.org>
List-Id: <solr-dev.lucene.apache.org>
Reply-To: solr-dev@lucene.apache.org
Delivered-To: mailing list solr-dev@lucene.apache.org
Received: (qmail 77934 invoked by uid 99); 8 Dec 2006 22:43:52 -0000
Received: from herse.apache.org (HELO herse.apache.org) (140.211.11.133)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 08 Dec 2006 14:43:52 -0800
X-ASF-Spam-Status: No, hits=-0.0 required=10.0
	tests=SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (herse.apache.org: domain of mike.klaas@gmail.com
 designates 66.249.92.171 as permitted sender)
Received: from [66.249.92.171] (HELO ug-out-1314.google.com) (66.249.92.171)
    by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 08 Dec 2006 14:43:42 -0800
Received: by ug-out-1314.google.com with SMTP id k40so952504ugc
        for <solr-dev@lucene.apache.org>;
 Fri, 08 Dec 2006 14:43:20 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=nLI7Dchl/xzht66sRcSuhOVXiKdI8KYvenOHnyH1ARfZhm+cPD+9IYTH7FBE5B5ih/46jDAUzd3yCfliRo3fo5TVPH/fNTb8jZF8iP3BimiXRpO8UvkC3pxinjmLFoU7ErFnzVzu7ZUgz2+4/gotWL4lK4VlSXRYBdipi1FLKeI=
Received: by 10.78.118.19 with SMTP id q19mr1782985huc.1165617799730;
        Fri, 08 Dec 2006 14:43:19 -0800 (PST)
Received: by 10.78.172.1 with HTTP; Fri, 8 Dec 2006 14:43:19 -0800 (PST)
Message-ID: <3d2ce8cb0612081443s7e5bb364p60da9560bd9ea962@mail.gmail.com>
Date: Fri, 8 Dec 2006 14:43:19 -0800
From: "Mike Klaas" <mike.klaas@gmail.com>
To: solr-dev@lucene.apache.org, simon.willnauer@gmail.com
Subject: Re: Re: "correct" format for the md5 files?
In-Reply-To: <f18c9dde0612081412w48ba9432ldc6f9825677b67f0@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <Pine.LNX.4.58.0612080101220.17470@hal.rescomp.berkeley.edu>
	 <f767f0600612080151q28ed1214t6f25f092d342f4b8@mail.gmail.com>
	 <f18c9dde0612081337l70942f4bt2abb0f552c861d7d@mail.gmail.com>
	 <20A4675A-E0B5-42A2-8AFC-97F0FF0A83EA@whirlycott.com>
	 <f18c9dde0612081408nd76351du4daf578b367f99a4@mail.gmail.com>
	 <f18c9dde0612081412w48ba9432ldc6f9825677b67f0@mail.gmail.com>
X-Virus-Checked: Checked by ClamAV on apache.org

On 12/8/06, Simon Willnauer <simon.willnauer@googlemail.com> wrote:
> Oh by the way I do have 2 people in this room being able to find
> collisions to md5 within the next 15 minutes. But it is true that this
> is quiet hypothetical .
>
> anyway...

Can they also produce a malicious distribution of solr which hashes
identically? <g>.

It _is_ a valid concern in general (I would never use md5 as a
cryptographic hash, e.g., for passwords), but significantly less of a
concern for this use.  The most important role of the hash is to
ensure no corruption occurred during transfer.

cheers,
-Mike