Public SourceMage Discussion List

["Jeremy Blosser (emrys)" <jblosser-smgl AT firinn.org>]

Andrew has noted there is no keyserver involvement, but I wanted to note
how that clarification affects a lot of the questions here:

On Aug 31, Sergey A. Lipnevich [sergey AT optimaltec.com] wrote:
> On Wed, 2005-08-31 at 09:27 -0700, Andrew wrote:
> > Technically speaking, you dont have to revoke the key. You resign the
> 
> Can you do that? I mean, is there a feature of GPG that allows to revoke
> individual signature? If there isn't, replacing a signature in grimoire
> tarball is the same as replacing a hash.

GPG doesn't allow this to my knowledge, but since the only time these keys
and signatures are used is inside of sorcery, we could publish our own
per-signature revocation list and it would do the job.  I do not prefer
this solution, but it is possible.

> > tarball then, publish the grimoire, its the same thing, the old bad
> > signature isn't in any accesible grimoire, no more than the bad hash
> > would be. The problem that key revocation solves is to protect un-updated
> > grimoires already in the field, where either the hash, or the signature
> > have been compromised. Hashes alone do not solve this problem. If cast can
> 
> Well, I believe they solve it sufficiently well actually: having an
> Internet connection is all it takes. You download a new grimoire tarball
> which you have to do anyway to get a new hash/signature. But in
> signatures case, there's an added step of contacting key server for
> every key and making sure it's not revoked. Remember also that the key

The key is in the grimoire, you get it at the same time you get the new
spell.

> revocation makes all signatures by this key invalid. So *all* signatures
> by the developer who signed the malicious tarball, have to be detected
> and deleted.

This is dead simple to script.

> Moreover, updated hash is as easy to find as updated signature.
> 
> > notice that the key is revoked automatically, then it can fail where a
> > simple hash would not.
> 
> I didn't really get why the "simple hash" wouldn't fail. Do you mean in
> the case where the user didn't download the new grimoire? Well, they

Yes.

> would learn that the key is tainted, but not until they download the new
> grimoire they can do anything about it anyway. It's the same as Red Hat

But we don't install a tainted spell before they figure this out.  The
attack and the solution is the same for hashes or signatures, apart from
some implementation details.

> asking people to update to the new package: posting a note on the site
> is almost as good as detecting a tainted key.
> 
> Sergey.

Attachment: pgpzfsYgRaiII.pgp
Description: PGP signature