Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

On Aug 29, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
> > It is at best disingenious to continue to act as though signatures can 
> > only
> > have one meaning.  Digital signatures are today used in the real world for
> > more than one thing.  Our signatures on our grimoires -- which encompass 
> > the
> 
> I disagree. Signature means essentially one thing: you personally accept
> responsibility for something. Try "define:signature" in Google or look it
> up on M-W.com and you will see the key theme behind all relevant
> definitions: identity of the signee.

Well, yes, let's bring out the reference materials and see what they say
about signatures.  First, note that your key theme of "identity of the
signee" is not itself related to "personally accept[ing] responsibility for
something".

'define:signature' on Google, the most generic approach, speaks more about
individual cursive style when talking about signatures than anything else.
There's also lots of talk of what 'signature' means in regards to
mathematical funtions and sewing, but neither of those are relevant.

www.m-w.com speaks entirely about a 'distinctive mark' and says nothing
about personal responsibility for content.  And of course doesn't speak to
digital signatures at all.  So let's check wikipedia, which actually has a
page on digital signatures, at: http://en.wikipedia.org/wiki/Digital_signature
I'm not really someone who likes to treat wikipedia as an authoritative
reference work, but they do a good job here of describing what signatures
do and don't do.  And none of it has anything to do with responsibility for
content.  The three they list are authenticity, integrity, and
non-repudiation.  Non-repudiation is the closest to the kind of single
meaning you're trying to attach to signing something, but again, a digital
signature only functions in that regard to establish that the signee was
the one that signed something.  What the act of signing meant and what they
can and can't disclaim about the content is always taken from the context
of the signature itself.

> >> Please read my original item #4. Using Jeremy's analogy, signing an email
> >
> > Again, I wasn't making an analogy, I was making a point that signatures 
> > can
> > mean more than one thing, and people are used to this.
> 
> I'm sorry, but your point is invalid in my eyes, for the reason I have 
> stated
> multiple times.

Yes, it's clear you know what you think and aren't interested in changing
your opinion.  However, established practice and definitions are not in
line with that opinion, so please don't expect we'll agree with it.  As I
noted before, even our own grimoire and sorcery tarball signatures fit this
broader model.  The primary use and meaning of a cryptographic signature is
in point of fact transmission integrity verification.  Non-repudiation is a
valid secondary use, but only in the context of that primary use, and even
then it doesn't go where you are trying to make it go.

> >> So, I would agree to sign the *spell* that I altered, but not the
> >> *source* coming from a 3rd party web site.
> >
> > I ask again, would it make you feel any better to use a key that did not
> > have your name on it, but instead had a name indicating it was a source
> > integrity verification key only.
> 
> If you have a good plan for managing such a key so that developers cannot
> willingly or unwillingly frame each other, I'd like to hear it.

I wasn't suggesting a common key, I was suggesting individual keys that
would make it completely clear that it isn't "Sergey's key", it's "a
distribution download integrity verification key".

Attachment: pgp936yOPrsNz.pgp
Description: PGP signature