[SM-Discuss] Threat profile analysis for spackages not signed by authors
Jeremy Blosser (emrys)
jblosser-smgl at firinn.org
Wed Aug 31 11:05:17 EDT 2005
On Aug 31, Jeremy Blosser (emrys) [jblosser-smgl at firinn.org] wrote:
> This raises the point though that sorcery should be checking a gurus.gpg
> revocation list on the first cast of each 24-hour period or something.
> Note that doing the same thing with regular hashes would be more difficult,
> since we'd basically have to implement the idea of a revocation list in
> sorcery ourselves, then publish a list of any known bad hashes for sorcery
> to pull.
On further thought we'd need to look more into what the revocation certs
GPG generates can be ingested by; we aren't running a keyserver. So we may
need to implement some support for revocation lists ourselves regardless.
This raises the point that this is an attack we currently can't stop via
GPG or hashes. If we want to prevent it, there is work to be done
regardless. This makes the question of what sorcery supports the central
point, as it's not a matter of not removing existing support, but adding
new support. And if sorcery chooses not to implement protection for
regular hashes against this kind of attack you have identified, should we
still include any support for them if we know they are vulnerable?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 232 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20050831/fe2ba421/attachment.bin
More information about the SM-Discuss