Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Thu, 1 Sep 2005 16:07:22 -0700

missed this one the first time around...

On Wed, Aug 31, 2005 at 06:56:25PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 11:16 -0700, Seth Alan Woolley wrote:
> > It was indirect. More indirect than a simple hash. The problem case --
> > the out of context discovery of the source and your signature, is what
> > worried you. When the identity is forced to go through a disclaimer
> > (yes this is indirect) such as a click-wrap, you're still disturbed -- I
> > just don't know why.
> >
> > How is it still direct to you?
>
> I said I don't see this disclaimer changing anything. Hence, presence of
> disclaimer anywhere doesn't change much for me.

DETAILS signing is no disclaimer -- I would be more worried that
somebody intuited the presence of the hash as being an implication of
quality of the tarball.

>
> > > I tried to show that even from technical POV using GPG signatures (see
> > > all the
> > > assumptions in my other message) is not a good idea. I'd appreciate if
> > > you let
> > > me know, based on my threat analysis, why I should subject myself to the
> > > scrutiny of keys if in our case hashes provide the same threat
> > > protection with
> > > added convenience of not being personal?
> >
> > I provided a technical means to remove the personal connection (but
> > retain non-repudiation) from your key. I still didn't see a direct
> > response to it.
>
> My key is my key, right? No matter how we dance around it I'd become an
> originator of this tarball. And if the tarball is compromised, I'd have
> to revoke this key.

Actually, you revoke the key when your key is compromised, not when a
tarball is compromised.

When an apache tarball is compromised, they don't revoke their signing keys.
Whe GNU was compromised, they didn't revoke their keys.

They sent a signed message that something was wrong with something they
signed (in the case of APACHE) or distributed (in the case of GNU) -- we
have ways to do the same.

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgp6dYxEwlT4D.pgp
Description: PGP signature



  • Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support, Seth Alan Woolley, 09/01/2005

Archive powered by MHonArc 2.6.24.

Top of Page