theupdateframework / pep-on-pypi-with-tuf

PEP 458: Securing the Link from PyPI to the End User
The Unlicense
6 stars 2 forks source link

Hash collisions should be reported #4

Open trishankkarthik opened 10 years ago

trishankkarthik commented 10 years ago

Currently, we recommend that hash collisions can somehow be automatically handled. Since cryptographic hash algorithms should make hash collisions extremely unlikely, it is safer and acceptable to simply require the server to report an error.