Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 08:03:28 -0400

Quoting Seth Alan Woolley <seth AT positivism.org>:

DRAFT, although this is one case where we're actually moving on it
quickly, so it's more of a last call for objections.


So here goes: I object.

1. Hash collision is not a problem when it comes to source tarballs, so please
don't use it as a reason to switch to signatures. We could've as easily hashed
them with CRC32 or with 10K-bit hash. *Either* way provides *no* security.
2. There's no way I can sign a bunch of code I didn't read through and
understand. It's an impossible task in a distribution, so it's shorter to say
that I can't sign a bunch of code, period.
3. Let's be frank Seth, tarballs that you, or anyone else besides the authors,
signed are as *insecure* as they were before you did that. It didn't format
your hard drive? Good for you. Maybe it's designed to format only *mine*. Or
the drive of the guy who works for CIA ot Chinese government. You don't know
that.
4. Combination of #2 and #3 leads me to believe that we do not provide *any*
additional security over unsigned tarballs, so let's focus on *integrity*.
Integrity is *perfectly* verified by the hash. Stronger hash if necessary, but
nevertheless a hash. Non-personified piece of information.
5. What people keep saying on the list amounts to: let's call it blue even
though it's black. Meaning, let's call GPG signature a means to verify
integrity even though it's a means to verify source and integrity. I don't buy
that.

Don't get me wrong, I believe that PGP and GPG are one of the most overlooked
technologies of the present time, in the light of PKI having so many unresolved
and abandoned issues. So, I support use of GPG signatures, but for the correct
purpose. Verifying integrity of the source tarballs is not a sufficient
purpose.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page