Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

> content.  The three they list are authenticity, integrity, and
> non-repudiation.  Non-repudiation is the closest to the kind of single
> meaning you're trying to attach to signing something, but again, a digital



> signature only functions in that regard to establish that the signee was
> the one that signed something.  What the act of signing meant and what they

What you're saying is that signing something doesn't mean anything except that
it was signed by <person>. Why then your signature on a blank piece of paper
different from a signature on a contract?

> > >> Please read my original item #4. Using Jeremy's analogy, signing an email
> > >
> > > Again, I wasn't making an analogy, I was making a point that 
> > signatures can
> > > mean more than one thing, and people are used to this.
> >
> > I'm sorry, but your point is invalid in my eyes, for the reason I 
> > have stated
> > multiple times.
>
> Yes, it's clear you know what you think and aren't interested in changing
> your opinion.  However, established practice and definitions are not in
> line with that opinion, so please don't expect we'll agree with it.  As I

We're claiming the same thing here :-), that there's an "opinion" and
"definitions" regarding signatures. Only I claim that they are rigid and you
claim they're flexible.

In regards to others disagreeing with me, I see only you for now. Anyway, I
don't ask you or anyone else to agree, I am simply saying that non-author
signatures are too much. I'm happy with a status quo right now: I and others
who don't want to sign 3rd party packages can use SHA1 hashes to allow 
users to
verify integrity of tarballs. Simply don't force me to accept your point of
view, as I am not forcing you to accept mine. Both can coexist and actually do
coexist right now. I am requesting not to change that.

> noted before, even our own grimoire and sorcery tarball signatures fit this
> broader model.  The primary use and meaning of a cryptographic signature is
> in point of fact transmission integrity verification.  Non-repudiation is a

Sorry, but this is not true. Use a differerent channel to pass a hash 
value for
your content and you'll achieve the same purpose: integrity is verified. If I
have to send a file to you, the easiest way to check integrity would be 
to send
the file by email and either send hash with it or send hash via ICQ for
instance. Or publish this hash value on a widely known server and allow 
copying
it everywhere, like ISO publishers usually do. In all cases, integrity means
that the file is not altered in transmission. Signature claims something *in
addition* to that.

> > >> So, I would agree to sign the *spell* that I altered, but not the
> > >> *source* coming from a 3rd party web site.
> > >
> > > I ask again, would it make you feel any better to use a key that did not
> > > have your name on it, but instead had a name indicating it was a source
> > > integrity verification key only.
> >
> > If you have a good plan for managing such a key so that developers cannot
> > willingly or unwillingly frame each other, I'd like to hear it.
>
> I wasn't suggesting a common key, I was suggesting individual keys that
> would make it completely clear that it isn't "Sergey's key", it's "a
> distribution download integrity verification key".

If it's my personal key, no. It doesn't matter what it says. If it's somehow
shared (I don't know if it's possible with GPG), than see my question above
about the plan to manage it.

Sergey.