Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: David Kowis <dkowis AT shlrm.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Mon, 29 Aug 2005 15:01:51 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sergey A. Lipnevich wrote:
> Quoting "Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>:
>
>
>>content. The three they list are authenticity, integrity, and
>>non-repudiation. Non-repudiation is the closest to the kind of single
>>meaning you're trying to attach to signing something, but again, a digital
>>signature only functions in that regard to establish that the signee was
>>the one that signed something. What the act of signing meant and what they
>
>
> What you're saying is that signing something doesn't mean anything except
> that
> it was signed by <person>. Why then your signature on a blank piece of paper
> different from a signature on a contract?
I'm going to have to agree with Jeremy on this. A signature can be defined to
mean anything the "contract" defines it to be. For example:
When I got a speeding ticket in the past, I had to sign it. It was not an
admission of guilt, just an agreement to do something about the
ticket. And that's it. A gpg signature of the source tarball is perfectly
acceptable, since we've defined our signature to verify that if
the signature's good, then you got the exact same source that the spell
writer used when he/she/it developed the spell.

>
>
>>>>>Please read my original item #4. Using Jeremy's analogy, signing an email
>>>>
>>>>Again, I wasn't making an analogy, I was making a point that
>>>signatures can
>>>>mean more than one thing, and people are used to this.
>>>I'm sorry, but your point is invalid in my eyes, for the reason I
>>>have stated
>>>multiple times.
>>
>>Yes, it's clear you know what you think and aren't interested in changing
>>your opinion. However, established practice and definitions are not in
>>line with that opinion, so please don't expect we'll agree with it. As I
>
>
> We're claiming the same thing here :-), that there's an "opinion" and
> "definitions" regarding signatures. Only I claim that they are rigid and you
> claim they're flexible.
There's no specific definition as to what a signature means. That's why
you're told (at least, I was) to always read anything you've got to
sign so that you know what you're agreeing to when you sign it. We've (by we
I mean the Sourcemage team) has made it quite clear that we're
not verifying that the source won't kill your mom, but that it's the same
source we got when we built our spell.

>
> In regards to others disagreeing with me, I see only you for now.
I see nothing wrong with using gpg signatures for source verification.

>Anyway, I
> don't ask you or anyone else to agree, I am simply saying that non-author
> signatures are too much. I'm happy with a status quo right now: I and others
> who don't want to sign 3rd party packages can use SHA1 hashes to allow
> users to
> verify integrity of tarballs. Simply don't force me to accept your point of
> view, as I am not forcing you to accept mine. Both can coexist and actually
> do
> coexist right now. I am requesting not to change that.
>
I think that one can never have enough security. especially when it doesn't
affect anything. There's a script under development, similar to
md5unpack to make gpg signing of source easy.
>
>>noted before, even our own grimoire and sorcery tarball signatures fit this
>>broader model. The primary use and meaning of a cryptographic signature is
>>in point of fact transmission integrity verification. Non-repudiation is a
>
>
> Sorry, but this is not true. Use a differerent channel to pass a hash
> value for
> your content and you'll achieve the same purpose: integrity is verified. If
> I
> have to send a file to you, the easiest way to check integrity would be
> to send
> the file by email and either send hash with it or send hash via ICQ for
> instance. Or publish this hash value on a widely known server and allow
> copying
> it everywhere, like ISO publishers usually do. In all cases, integrity means
> that the file is not altered in transmission. Signature claims something *in
> addition* to that.
Acutally the easiest way to send a file to someone would be to use GPG. Sign
it and then the receiver simply verifies the signature. Things
like you just described are precisely what Public Key Infrastructure is for.
Publishing a hash value on a widely known server is flawed. If
that signature is compromised, how does one verify it? with another hash on
another server? This can chain off into oblivion.
IMO, ISO publishers did this because gpg wasn't widely available.
>
>
>>>>>So, I would agree to sign the *spell* that I altered, but not the
>>>>>*source* coming from a 3rd party web site.
>>>>
>>>>I ask again, would it make you feel any better to use a key that did not
>>>>have your name on it, but instead had a name indicating it was a source
>>>>integrity verification key only.
>>>
>>>If you have a good plan for managing such a key so that developers cannot
>>>willingly or unwillingly frame each other, I'd like to hear it.
>>
>>I wasn't suggesting a common key, I was suggesting individual keys that
>>would make it completely clear that it isn't "Sergey's key", it's "a
>>distribution download integrity verification key".
>
>
> If it's my personal key, no. It doesn't matter what it says. If it's somehow
> shared (I don't know if it's possible with GPG), than see my question above
> about the plan to manage it.
Sub-keys of a master key. I think anyway. Your specific "Source signing key"
would be signed by the master "SGML SOOPER SOURCE key".

I've contributed my sanity to this madness.
or is it my madness to this sanity...?

- --
David Kowis

ISO Team Lead - www.sourcemage.org
SourceMage GNU/Linux

Progress isn't made by early risers. It's made by lazy men trying to find
easier ways to do something.
- Robert Heinlein

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFDE2mvtgErhgxHMHsRAnf5AJ42hdROTUAjU+kWEUiLJ5gIra+WDACggOzL
sJ5UxtFX9jErhpbiOlzhPjI=
=hQPu
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page