[SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
Sergey A. Lipnevich
sergey at optimaltec.com
Mon Aug 29 16:24:08 EDT 2005
Quoting David Kowis <dkowis at shlrm.org>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Sergey A. Lipnevich wrote:
>> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl at firinn.org>:
>>
>>
>>> content. The three they list are authenticity, integrity, and
>>> non-repudiation. Non-repudiation is the closest to the kind of single
>>> meaning you're trying to attach to signing something, but again, a digital
>>> signature only functions in that regard to establish that the signee was
>>> the one that signed something. What the act of signing meant and what they
>>
>>
>> What you're saying is that signing something doesn't mean anything
>> except that
>> it was signed by <person>. Why then your signature on a blank piece of paper
>> different from a signature on a contract?
> I'm going to have to agree with Jeremy on this. A signature can be
> defined to mean anything the "contract" defines it to be. For example:
But you have to read this contract, not just say that there are no spelling
errors in it. Why do I feel like I'm bagning against the wall here? Why do I
never get a straight answer to the question "would you sign something you
didn't read?"
> When I got a speeding ticket in the past, I had to sign it. It was
> not an admission of guilt, just an agreement to do something about the
Right, you accepted the responsibility. You'd be arrested if you refused to
sign.
> ticket. And that's it. A gpg signature of the source tarball is
> perfectly acceptable, since we've defined our signature to verify
> that if
Acceptable, yes, thank you! But not mandatory.
> There's no specific definition as to what a signature means. That's
> why you're told (at least, I was) to always read anything you've got
> to
> sign so that you know what you're agreeing to when you sign it. We've
Exactly! And I can't read the source, there's too much of it. How can I
sign it
then? If you can do that, please go ahead, but don't force me along this path.
> (by we I mean the Sourcemage team) has made it quite clear that we're
> not verifying that the source won't kill your mom, but that it's the
> same source we got when we built our spell.
Then don't use a signature.
> I see nothing wrong with using gpg signatures for source verification.
Neither do I. I see a lot of things wrong with signing something I
couldn't read
in advance. Did I say I don't aim to stop anyone from signing anything, I just
don't want to participate in this myself or see anyone else forced into it
against their will?
> I think that one can never have enough security. especially when it
Signing something you didn't read can only take security away from you, not
provide more of it.
> doesn't affect anything. There's a script under development, similar to
> md5unpack to make gpg signing of source easy.
Right. What about a script that unbinds you from a signed contract in
real life?
Did I ever say I don't want to do it because it's difficult? I don't think so.
> Acutally the easiest way to send a file to someone would be to use
> GPG. Sign it and then the receiver simply verifies the signature.
If you have a verified key, yes. If your key is lost or stolen, no.
Hashes don't
impose such limits.
> like you just described are precisely what Public Key Infrastructure
> is for. Publishing a hash value on a widely known server is flawed. If
PKI and GPG are two very different things.
How is it "flawed" from the *integrity* point of view? I agree that it doesn't
provide *security*, I said that in item #1 of my original email.
> that signature is compromised, how does one verify it? with another
> hash on another server? This can chain off into oblivion.
> IMO, ISO publishers did this because gpg wasn't widely available.
Regardless of why they do it, it works: integrity can be verified and is
verified on a computer near you. No keys involved.
>> If it's my personal key, no. It doesn't matter what it says. If it's somehow
>> shared (I don't know if it's possible with GPG), than see my question above
>> about the plan to manage it.
> Sub-keys of a master key. I think anyway. Your specific "Source
> signing key" would be signed by the master "SGML SOOPER SOURCE key".
>
> I've contributed my sanity to this madness.
> or is it my madness to this sanity...?
If we can agree on not making GPG signatures mandatory, we can stop
right away.
I'm not interested in preaching on this subject, I just want my freedom of
choice back.
Sergey.
More information about the SM-Discuss
mailing list