MantisBT - CMake
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0015060CMakeDocumentationpublic2014-08-05 10:452015-01-05 08:39
ReporterNico Schlömer 
Assigned ToBrad King 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOSOS Version
Product Version 
Target VersionCMake 3.1Fixed in VersionCMake 3.1 
Summary0015060: "This is not security software." too sloppy
DescriptionIn the documentation of ExternalData <http://www.cmake.org/cmake/help/v3.0/module/ExternalData.html>, [^] the following comment appears:

> Note that the hashes are used only for unique data identification and download
> verification. This is not security software.

This is too sloppy. It should probably read something like:

Note that, while there are a feasible collision attacks on MD5, there is no known feasible second-preimage attack. MD5 is thus still considered appropriate for download verification.
Steps To Reproduce
Additional Information
TagsNo tags attached.
Relationships
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2014-08-05 10:45Nico SchlömerNew Issue
2014-08-05 11:17Brad KingNote Added: 0036555
2014-08-05 11:18Nico SchlömerNote Added: 0036556
2014-08-05 11:31Brad KingNote Added: 0036557
2014-08-05 11:31Brad KingAssigned To => Brad King
2014-08-05 11:31Brad KingStatusnew => assigned
2014-08-05 11:31Brad KingTarget Version => CMake 3.1
2014-08-07 12:42Brad KingStatusassigned => resolved
2014-08-07 12:42Brad KingResolutionopen => fixed
2014-08-07 12:42Brad KingFixed in Version => CMake 3.1
2015-01-05 08:39Robert MaynardNote Added: 0037610
2015-01-05 08:39Robert MaynardStatusresolved => closed

Notes
(0036555)
Brad King   
2014-08-05 11:17   
Perhaps it is best to simply drop the "This is not security software." sentence and let people do their own research into the current strength of each hash algorithm. Otherwise any claim we state may be outdated later.
(0036556)
Nico Schlömer   
2014-08-05 11:18   
Even better.
(0036557)
Brad King   
2014-08-05 11:31   
Done, thanks:

 ExternalData: Drop 'not security software' disclaimer
 http://cmake.org/gitweb?p=cmake.git;a=commitdiff;h=f2ccc14b [^]
(0037610)
Robert Maynard   
2015-01-05 08:39   
Closing resolved issues that have not been updated in more than 4 months