Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 23:04:31 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 31 Aug 2005, Sergey A. Lipnevich wrote:
Quoting Seth Alan Woolley <seth AT positivism.org>:

What circumstance would make acceptable a third-party source signing by
a member of our team?

No, see my answers above and the "threat profile" message.

No circumstances?

I'm afraid none of the circumstances would involve directly associating my
identity with any 3rd-party package, regardless of the disclaimer, so the
answer is still negative, sorry.

Seth mentioned a way to obfuscate your identify from the key, if it's
that important to you that people not know that you're the one who
downloaded the tarball, even though the HISTORY entry will say you did.

I tried to show that even from technical POV using GPG signatures (see all the
assumptions in my other message) is not a good idea. I'd appreciate if you let
me know, based on my threat analysis, why I should subject myself to the
scrutiny of keys if in our case hashes provide the same threat protection with
added convenience of not being personal?

Here's one reason: Simplicity of us not having to be cryptography
experts. As mentioned before we can let the GPG developers be that.
All we do is use GPG's default hashes and we're good. If we go with
specific hashes then we have to keep up with breakage (md5sum,
sha1sum, etc.), figure out which new hash to use, think of when it'll
break, rinse and repeat.

- -sandalle

- --
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFpnwHXt9dKjv3WERAsoEAJ9/XzFufpOWUA7OYxVEJdkAcR+jFQCgn/zY
9o55R5mN/ISRbftM6CkX8j0=
=8D1X
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page