Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 10:50:27 -0400

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
Quoting Seth Alan Woolley <seth AT positivism.org>:

> DRAFT, although this is one case where we're actually moving on it
> quickly, so it's more of a last call for objections.
>

So here goes: I object.

1. Hash collision is not a problem when it comes to source tarballs, so please
don't use it as a reason to switch to signatures. We could've as easily hashed
them with CRC32 or with 10K-bit hash. *Either* way provides *no* security.

If someone is able to modify the sources while keeping the hash intact, we
can't detect it just checking the hash. This is a problem. If we're using

I would agree with you if there were an example of that. Examples of generating
a collision in the hash don't count because they do not produce a valid source.
Or, I should say, do not produce valid source yet. Chances of this happening are
much lower than producing a hash collision.

signatures instead of just hashes, they have to modify the signature in
place instead of just the hash it's based on or subvert the private key and
re-sign. For guru-signed spells especially the private key is going to be
stored somewhere completely different from the upstream sources; the
attacker changing the upstream sources isn't likely to even be aware of our
signatures and keys.

I don't argue that GPG key is worse. It *is* better, I agree. However, I argue
that hash is *sufficient* for a long time, and GPG signature if not coming from
the author is excessive and misleading. If maintainers want to sign packages, I
don't mind, but I can't consciously do that.

2. There's no way I can sign a bunch of code I didn't read through and
understand. It's an impossible task in a distribution, so it's shorter to say
that I can't sign a bunch of code, period.

As we've said several times, guru signatures explicitly do not mean that
you've read the source, they only mean that a source which passes the

Please read item #4 again. You're trying to substitute a different meaning for a
meaning that is already there. It may work for you, but not for me, and I argue
that it is not going to work for other people. People *will* be misled by GPG
signatures. More aggressive people will blame *you* as the signee. It's like
helping the police by shooting and killing their suspect: you've helped them in
their purpose, but at what price? Police needs help from you in identifying
suspects and informing the authorities, but not in doing your own justice. What
I'm saying is, you're putting too much responsibility upon yourself even though
you disclaim it. It your choice, but don't force me to do the same.

signature check is the same as what you downloaded. I don't think we can
say this any clearer than we have, so the fact it keeps coming up means to
me that people just don't want to hear it. There's simply no reason a
signature has to mean more than we tell our users it means. It's not even

Yes there is. Signing a document means you *read* it and *agree* with it. Why
signing a tarball shouldn't mean the same.

3. Let's be frank Seth, tarballs that you, or anyone else besides the authors,
signed are as *insecure* as they were before you did that. It didn't format
your hard drive? Good for you. Maybe it's designed to format only *mine*. Or
the drive of the guy who works for CIA ot Chinese government. You don't know
that.

Of course they're just as insecure with the signature. That's not the
point. The point is that if I sign something at point in time A, and you
get it at point in time B and the signatures still match, then at point in
time B it is at least *not any more insecure* than it was at point in time
A.

Hashes are sufficient for that. I object to making signatures mandatory.

4. Combination of #2 and #3 leads me to believe that we do not provide *any*
additional security over unsigned tarballs, so let's focus on *integrity*.
Integrity is *perfectly* verified by the hash. Stronger hash if necessary, but
nevertheless a hash. Non-personified piece of information.

This is what we've been saying for quite some time. We make no guarantees
the source won't destroy someone's system, just that download integrity was
preserved. And we want to use GPG for that instead of a simple hash
because it a) requires an attacker to expend more resources to subvert the
integrity check, and b) lets us offload much of the check itself to people
better equipped to handle it than we are. The Unix way.

a) is true but it's overkill; attacker would have not only have to create a hash
collision, but make sure this collision has a meaning, e.g. be compileable or
executable; I'm willing to change this viewpoint if there's one confirmed study
that shows just such a hash collision;
b) is good for package authors, and is a perfect reason *not* to make signatures
mandatory.

5. What people keep saying on the list amounts to: let's call it blue even
though it's black. Meaning, let's call GPG signature a means to verify
integrity even though it's a means to verify source and integrity. I don't buy
that.

Again, there's no reason it has to mean this. If you sign for a package
delivered to your neighbor, does it bind you to any claims that the package
isn't a mail bomb? Signatures are used for all kinds of things in the real
world and digital world. What it means is what we say it means.

You're signing the receipt, meaning you agree that you received the package.
There's no analog that I can think of in terms of source code tarballs. Package
has been accepted by the carrier, inspected for controlled objects, and was
wrapped. Package has a return address that has likely been verified, and a
trail of how it got to you. There's no wrap or return address on tarballs, and
nobody inspects them.
However, see above about the analogy of signatures on documents. I think it
suits better.

In short, I object to *mandatory* GPG signatures, and I refuse to sign source
that's not mine with my name.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page