Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Seth Alan Woolley <seth AT positivism.org>
  • Cc: SM-Discuss <sm-discuss AT lists.ibiblio.org>
  • Subject: Re: [SM-Discuss] STRONGER POLICY for gpg signatures to replace MD5[*] and ALSO new SOURCE_HASH support
  • Date: Wed, 31 Aug 2005 08:13:37 -0400

Quoting Seth Alan Woolley <seth AT positivism.org>:

I'll explain standards however I want to. If they are wrong, people
will reply thusly. If they are correct, they will be accepted.

Unfortunately, you can't explain standards this way. If the standard is
ambiguous, it's not a good standard. Your explanations are taking advantage of
the wording that does not define certain terms, and you in good faith have to
acknowledge the fact that you're no a recognized authority on this subject,
when doing so.

If the explanation below reinforces your point, we should dump
SOURCE_HASH too.

No, please see my "threat analysis" message.

Words like "authenticity" and "identity" run through your citings of
FIPS-186. I don't want people coming to *me* to check authenticity of
xyz-1.2.3.tar.bz2,

They check the *authenticity* of the *sender*, not of the tarball. They
check the *integrity* of the *tarball*.

Gotcha! When you say Nike shoes are authentic, it doesn't mean that Nike is
authentic. You're saying this about the thing Nike produced. Us signing
tarballs is like putting a seal of approval without really analyzing the
subject of this approval. So, fallacy of your logic is: there is no such thing
as authenticity of the sender, there's only authenticity of the tarball.

Let's say they do come to you to check the integrity. Is that not what
happens currently with hashsums?

I want it to remain an option.

And a HISTORY file for authentication.... Your identity!

History record doesn't mean I read the tarball.


OK, we'll issue you a random number, the comment field links to the
security policy. The name contains the number (which will most likely
be a hashsum of your name). There will be no easy way for people to get
to your randomly issued number back to your identity unless they look up
a list in our security policy where they will clearly read about what
the signature means. We can even throw away the index and make it hard
to authenticate but easy to non-repudiate.

Then your identity isn't associated with it more than your signing of a
spell. In fact, less so.


And just so I know, do you keep in mind that I am not opposing the use of
signatures? I am opposing the mandatory use.

What circumstance would make acceptable a third-party source signing by
a member of our team?

No, see my answers above and the "threat profile" message.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page