Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

On Wed, 2005-08-31 at 09:27 -0700, Andrew wrote:
> Technically speaking, you dont have to revoke the key. You resign the

Can you do that? I mean, is there a feature of GPG that allows to revoke
individual signature? If there isn't, replacing a signature in grimoire
tarball is the same as replacing a hash.

> tarball then, publish the grimoire, its the same thing, the old bad
> signature isn't in any accesible grimoire, no more than the bad hash
> would be. The problem that key revocation solves is to protect un-updated
> grimoires already in the field, where either the hash, or the signature
> have been compromised. Hashes alone do not solve this problem. If cast can

Well, I believe they solve it sufficiently well actually: having an
Internet connection is all it takes. You download a new grimoire tarball
which you have to do anyway to get a new hash/signature. But in
signatures case, there's an added step of contacting key server for
every key and making sure it's not revoked. Remember also that the key
revocation makes all signatures by this key invalid. So *all* signatures
by the developer who signed the malicious tarball, have to be detected
and deleted.

Moreover, updated hash is as easy to find as updated signature.

> notice that the key is revoked automatically, then it can fail where a
> simple hash would not.

I didn't really get why the "simple hash" wouldn't fail. Do you mean in
the case where the user didn't download the new grimoire? Well, they
would learn that the key is tainted, but not until they download the new
grimoire they can do anything about it anyway. It's the same as Red Hat
asking people to update to the new package: posting a note on the site
is almost as good as detecting a tainted key.

Sergey.