Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 15:47:05 -0400

Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:

content. The three they list are authenticity, integrity, and
non-repudiation. Non-repudiation is the closest to the kind of single
meaning you're trying to attach to signing something, but again, a digital



signature only functions in that regard to establish that the signee was
the one that signed something. What the act of signing meant and what they

What you're saying is that signing something doesn't mean anything except that
it was signed by <person>. Why then your signature on a blank piece of paper
different from a signature on a contract?

>> Please read my original item #4. Using Jeremy's analogy, signing an email
>
> Again, I wasn't making an analogy, I was making a point that signatures can
> mean more than one thing, and people are used to this.

I'm sorry, but your point is invalid in my eyes, for the reason I have stated
multiple times.

Yes, it's clear you know what you think and aren't interested in changing
your opinion. However, established practice and definitions are not in
line with that opinion, so please don't expect we'll agree with it. As I

We're claiming the same thing here :-), that there's an "opinion" and
"definitions" regarding signatures. Only I claim that they are rigid and you
claim they're flexible.

In regards to others disagreeing with me, I see only you for now. Anyway, I
don't ask you or anyone else to agree, I am simply saying that non-author
signatures are too much. I'm happy with a status quo right now: I and others
who don't want to sign 3rd party packages can use SHA1 hashes to allow users to
verify integrity of tarballs. Simply don't force me to accept your point of
view, as I am not forcing you to accept mine. Both can coexist and actually do
coexist right now. I am requesting not to change that.

noted before, even our own grimoire and sorcery tarball signatures fit this
broader model. The primary use and meaning of a cryptographic signature is
in point of fact transmission integrity verification. Non-repudiation is a

Sorry, but this is not true. Use a differerent channel to pass a hash value for
your content and you'll achieve the same purpose: integrity is verified. If I
have to send a file to you, the easiest way to check integrity would be to send
the file by email and either send hash with it or send hash via ICQ for
instance. Or publish this hash value on a widely known server and allow copying
it everywhere, like ISO publishers usually do. In all cases, integrity means
that the file is not altered in transmission. Signature claims something *in
addition* to that.

>> So, I would agree to sign the *spell* that I altered, but not the
>> *source* coming from a 3rd party web site.
>
> I ask again, would it make you feel any better to use a key that did not
> have your name on it, but instead had a name indicating it was a source
> integrity verification key only.

If you have a good plan for managing such a key so that developers cannot
willingly or unwillingly frame each other, I'd like to hear it.

I wasn't suggesting a common key, I was suggesting individual keys that
would make it completely clear that it isn't "Sergey's key", it's "a
distribution download integrity verification key".

If it's my personal key, no. It doesn't matter what it says. If it's somehow
shared (I don't know if it's possible with GPG), than see my question above
about the plan to manage it.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page