Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Fri, 26 Aug 2005 02:05:54 -0700

DRAFT, although this is one case where we're actually moving on it
quickly, so it's more of a last call for objections.

In an ad-hoc discussion in sourcemage-sorcery among people who hang out
there (not necessarily all stakeholders or interested parties), it was
agreed upon that we should skip md5 and sha-1 hashes and go straight to
using gpg. I'm going to create a custom key for myself and sign every
package with a stronger-than sha-1 hash, probably sha-256, although gpg
supports up to sha-512.

We also discussed the future direction of gpg support in sorcery and
decided that after reviewing a number of its options that we could
render the hashsum support in sorcery obsolete and deprecated. We also
changed around the SOURCEn_*m format to SOURCEn_*[m-1] format for
multi-validated sources (personal whim? ;)). This is in devel sorcery
now. Spells with more than one verification mechanism were set to
cascade and pass on any verification passing (the only spell with this
feature was hashsum, so far as I know). It was decided that it would be
better if it worked as an AND instead of OR function in approving
validation so we can do both vendor and guru signatures at the same
time, needing both to pass (related to bug 8579), rather than have this
as a user option (it really doesn't make sense as one). It was
originally intended to support hashsum, and if hashsum were not
installed, it could cascade down to a lower bit-length hash, but with
the use of gpg only, this wouldn't be needed anymore. Hashsum is also
x86 arch only last I checked, and so gpg is the only portable solution,
too.

And since md5 and sha-1 are well within the capabilities of modern
governments to collide, especially China ;), we are moving asap to gpg's
stronger hashes.

From now on, it is considered a bug not to be using SOURCE_GPG support
in sorcery on new spell edits and also a bug not to use sha-256 or
higher. ripemd-160 is supported, but I think it'll be next to fall at
the rate things are going.

I would like to point gurus to the gpg --digest-algo SHA512 command-line
switch when they generate their guru-signatures. DSA keys CANNOT be
used for this purpose though (160 bit hash for DSA is standard), so
generate an RSA key for this purpose. I know this means we'll see some
.gpg edits, but we'll live with it. :)

Note that for vendor keys, we simply do not have the ability to tell
them all to use higher hashes, so we're ignoring this issue for now.
This policy applies only to guru keys and I don't expect people to
guru-sign already vendor-signed keys. In fact, I prefer if we go out
and look for vendor keys first. If the vendor keys and hashes are too
weak, though, in their own judgement, gurus can do their own signatures
for the time being and use the SOURCEn_GPG[1] new array format to add
some extra protection.

I am going to start converting over the MD5[n-1] sources shortly to gpg
signatures. If there are any gurus who want to do this themselves,
please drop me an email so your spells (specify by name or section) can
be added to an exclusion list. I plan on doing it this weekend when I
will have some free time. I constantly hang out in #sourcemage,
-sorcery, -quality, -cauldron, and -security if you need help with what
commands to run and what to type.

I suspect old MD5[*] support in sorcery is going to last no more than
six months, so people should begin porting their local grimoires as soon
as possible as well.

Seth

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpWOvsUJ1ztI.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page