Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Tue, 30 Aug 2005 12:03:53 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Tue, 30 Aug 2005, Sergey A. Lipnevich wrote:
Quoting Eric Sandall <eric AT sandall.us>:

We're not asking you to sign your soul away. I cannot see how you are
completely missing the point of what we're saying. You are /not/
signing tarballs saying that you have audited the code (unless you
have, then you can say that), nor that you guarantee this tarball
won't break your computer, nor that this tarball has no viruses,
trojans, worms, wife beaters, etc. in it, nor that this tarball has no
bugs, nor many other things. The only thing the GPG signatures are for
is to replace the dependency on specific hashsums (md5sum, sha1sum,
etc.) and to allow for trusting the vendor's as much as we currently
trust them (I don't recall anyone doing audits of source code of any
packages for SMGL and no one complained that signing (yes, it's
technically a signature) with the md5sum said that you had done that).

Let me explain it differently because we keep walking around the same
issue. The
users don't care no matter how you describe your use of signatures. I
as a user
don't care how for example Apache Software Foundation describes their use of
signatures. When I, as a user, see a signature, I assume that they vouch for
contents of file, not just this file's integrity. That's how I treat
signatures. Tell me if I'm wrong, but you better have a good reason for it.
Maybe I as a user can go and read the authors' key policy, but ususally I'd do
that only when the actual problem comes up that prompts me to do so.

Even more so, Apache for example doesn't have any explanation. I tried
searching
the site and I can't find a policy. Please find me a policy on some major OSS
vendor site that says: GPG signatures are used for integrity only and do *not*
mean non-repudiation and authenticity *of the code*. This file for
example says
"signatures are used for code signing:"

http://svn.apache.org/repos/asf/lenya/trunk/KEYS

Did I make myself clear on why I don't care about what's written on our
Web site
about signatures, and nobody else does? I hope I did. Please understand that
*this* point is the beef of my argument. I tried to express it as item
#4 of my
original email, which was not understood well.

Now, as a maintainer, I am worried about perceived meaning of signatures. I do
not want my users to have a false feeling of security because the tarball is
signed. Moreover, I am not taking the responsibility of signing things I don't
read, even though you try to tell me that we have a disclaimer. With or
without
this disclaimer, I can't do that.

Finally, I'm saying, and we agree on that at least with you Eric, that hash
values do allow for detection of integrity problems. I argue that they are
sufficient, and there's no reason to go further. If package authors sign their
packages, we support GPG verification, otherwise all bets are off. But please
understand that this is just a secondary reason of why I can't sign a tarball.
If there were no such thing as hash value, I couldn't sign an alien tarball
anyway.

Finally, Seth here is telling us that signatures do not mean security.
Regardless of whether I agree or disagree with this, please understand that
signatures are perceived as means to provide additional layer of... what?
correct, *security*! Why do I think so? Let me put our friend Andrew on the
spot (I'm sorry Andrew, you made it too easy with your email to make my
point).
He recently wrote this:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2005-August/011907.html

Citing it: "This is part of my new security policy I'm implementing for
myself.
This key expires end of the year and I will issue a new one then."

So, people do perceive digital keys as a means of security. Not the
only means,
of course, but definitely an important one. In the U.S., you can sign
your name
now with the help of digital signature. Not GPG I think. Nevertheless, in the
public eye digital signature is very much alike the real deal. You can't try
and change this meaning just by posting a disclaimer on the site.

That doesn't mean that they see keys as /only/ for security, that's a
fallacy if that's how your logic is working.

The question is, are we clear now on what I am objecting to?

I think so. You're objecting to using something use see as only
allowable for one task (GPG signing saying I verified everything
inside this signage), where we are saying we can use it for whatever
we say we're using it for.

I don't think users will be confused, especially if we word it
correctly. Most probably won't even notice the difference (other than
faster checking since we no long uncompress the tarball to verify, but
that goes for the new SOURCE_HASH as well) until they get a corrupted
tarball and see that there was a GPG signature instead of an md5sum
signature that failed. Note: md5sum /signature/. That's basically what
an md5sum is: a signature. Same with sha{1,256,512,infinity*42)sum and
gpg.

This is where I'm having the problem with your argument. We're
replacing one type of signature (specific hashsum (e.g. md5, sha, blah
blah) with a hashum agnostic signature (gpg, currently using sha512,
but easily changed if that is easily broken). You seem to be trying to
say that the /only/ use for GPG is to say that we've checked over and
agree with all the contents of the signed file and that users will
become confused if we use any other method. What others have pointed
out is that GPG is used for other methods (the kernel.org people don't
say there are no bugs in the kernel sources they've signed, but that,
if you have the correct signature and it verifies the tarball you are
getting the /same/ tarball that they signed and uploaded. Nothing
more).

When I sign this e-mail I'm not saying I agree with everything in it
(as I obviously am disagreeing with your point ;)) and that there are
no errors in it (me fail English?), but that I sent this e-mail and,
if your e-mail reader verifies my GPG key, that this is the same
e-mail I intended you to receive and it hasn't been modified.

- -sandalle

- -- Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDFK2bHXt9dKjv3WERApxDAJwOu4iemymQkuNHQmEy9pFOef9XfgCeIhyl
Fn9IRaPYgL8hBxg/mJJPhJg=
=KHNu
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page