Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Fri, 2 Sep 2005 19:27:50 +0200

Hi all,

I agree with Sergey when he says :
>
> So, I support use of GPG signatures, but for the correct
> purpose. Verifying integrity of the source tarballs is not a sufficient
> purpose.
>

Why do we want to check integrity with gpg ? Right now, integrity of the sources is checked via MD5, and integrity and authenticity of the spells/grimoires is done via gpg. This does nicely what's it's designed to do. We talked about collisions. Even if it's possible to find collisions in a hash function, because of the birthday paradox (http://en.wikipedia.org/wiki/Birthday_paradox), it does not mean that you can alter the content and still have the same hash. However I do not mean that we should stick to MD5, a stronger hash is IMHO a good idea.

And even if gpg-signing the sources will only mean "these are the same as the one the spell-creator downloaded", I do not like the idea. The first problem is it can be misleading: when I download a source, and that it passes the signature checking, I understand it like "there is no integrity problem" AND "This comes from me, the developper" (or "according to the developers, as far as they know, there was no malicious code added in it"). But here we'll only check the integrity. Another problem is that we are already using gpg signature on the grimoires and on sorcery with the "classic" meaning... Having another meaning when it comes to the source will be misleading.


On 8/31/05, Ladislav Hagara <ladislav.hagara AT unob.cz> wrote:
> The beauty of hashes is that they don't need any extra support in
> addition to
> what's in sorcery now.


Moreover, if there is some integrity problem, even users can discuss
about their hashes, they can easily compare them.
In p4 reviews I see ascii changes, not only "binary file was changed".

Vendor signing is great but personally I would extra add our hash.
What about if for example home page of  wget is cracked, wget author's
key is stolen, new tarball with "rm -rf /*" is created and signed?
<snip>

Yep I like this idea. Why not always using a hash, and adding vendor signing when it's available ?

Just my two cents...
Thomas

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623  BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36


Archive powered by MHonArc 2.6.24.

Top of Page