News for hackers. Stuff that matters.

A comment on Microsoft is Abandoning SHA-1 Hashes for Updates. Parent comment

Re:Microsoft is Abandoning SHA-1 Hashes for Updates by craftyguy on Wednesday February 20, 2019 @12:54AM (#19205897)
> I think it would be quite the day to take the hashes of Microsoft's ISO images for Windows, and compare it with the source code

Wat? How would you translate an ISO hash into anything meaningful to compare to the actual source code (that you don't have access to, but that's beside the point) ?

Does microsoft enforce reproducible builds[0]? Even if they did, you couldn't reproduce it (no access to source). When you hash a large binary, like an ISO, you cannot deconstruct what, eh, sub-binaries it is made of, and you cannot magically decompile those, eh, sub-binaries into source code.

0. https://wiki.debian.org/ReproducibleBuilds

[ Parent | on HN ]
Re:Microsoft is Abandoning SHA-1 Hashes for Updates by anticensor on Wednesday February 20, 2019 @02:52PM (#19211352)
Microsoft enforces reproducible builds since 2017.
[ Parent | on HN ]
Re:Microsoft is Abandoning SHA-1 Hashes for Updates by craftyguy on Wednesday February 20, 2019 @09:18PM (#19213992)
Do you have a source for that (no pun intended)? Even if they did, it's impossible for anyone outside of microsoft to verify because, well, it's proprietary. So for those of us who trust microsoft as far as we can throw them, it doesn't really do much.
[ Parent | on HN ]
Re:Microsoft is Abandoning SHA-1 Hashes for Updates by anticensor on Thursday February 21, 2019 @03:40PM (#19220374)
Yes, see https://blogs.msdn.microsoft.com/oldnewthing/20180103-00/?p=... by Raymond Chen.
[ Parent | on HN ]
Re:Microsoft is Abandoning SHA-1 Hashes for Updates by techntoke on Wednesday February 20, 2019 @11:09AM (#19208998)
Yes, you can take a look at the source code and recompile the ISO to match the hash. If the compiled ISO hash doesn't match, then it isn't the same code.
[ Parent | on HN ]
Re:Microsoft is Abandoning SHA-1 Hashes for Updates by craftyguy on Thursday February 21, 2019 @12:55AM (#19214860)
No, you can literally do none of that with microsoft software.
[ Parent | on HN ]