Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Sukneet Basuta (sukneet AT gmail.com) wrote [11.12.01 13:30]:
> Ladislav Hagara stated to me that sha512 is equivalent to gpg
> verification, implying there is no reason to switch one to the other.
> I suppose this does make sense if it is not vendor signed. However,
> http://wiki.sourcemage.org/Source_Integrity_Checking_Standards states
> that everything should be switched over to gpg verification. Ladislav
> never responded to my reply below, so I decided I'd ask here.
> 
> Should I not be converting spells that already have sha512 hashes to
> gpg verification?
> 
> I noticed that quite a few spells have SOURCE_GPG commented out and
> instead have SOURCE_HASH. This seems to go against the wiki document I
> linked to above, granted that document is pretty old. So what is the
> official stance on this? Or does it ultimately not matter?

They are absolutely not equivalent. A signature is a very different
thing from a hash. The following discussion concerns theoretical
"perfect world" situations, as real-world implementations have added
problems (i.e., hash collisions, man-in-the-middle attacks, etc.).

Assuming the content of message M and developer D with GPG key K, there
can be both a signature S and a hashsum H. S guarantees that M was
signed by D, since only D has K and no one else. Thus, S *authenticates*
the source of M. H on the other hand is not tied to any particular
person, but only to the content of M. Thus, H does not authenticate at
all, it only verifies that the data in M is the same as some known
value. Therefore, H is used to guarantee that the M you receive is the
same as the M that is sent. S is used to guarantee who sent M, and who
you received M from (in this case, D). Because S also relies on the
content of M (D cannot sign a message he doesn't send), S can also be
used to verify that the M you receive is the same as the M that is sent,
subsuming the functionality of H.

However, as S and H are intended to perform different functions, and as
there are different algorithms for both S and H, it is possible that a
given S will be inferior to a given H for the purpose of integrity
verification. On the other hand, regardless of given algorithms, H is
*always* inferior to S for authentications, because H performs no level
of authentication at all, ever.

Again, the above discussion assumes a perfect world and ignores various
glitches and attack vectors. Regardless, the claim that the two are
equivalent is bogus.

As to whether upstream sources *should* be verified via signature or
hash is still an open question, but there was a prior discussion on this
ML precisely on this point where I mentioned the possibility to actually
do both (use the signature for the source itself, and use a hash for the
signature), which would theoretically provide the highest level we can
currently get for both integrity verification and authentication. There
are various benefits and drawbacks to all possibilities though (no
sig/hash checking, source_sig only, source_hash only, or
source_sig+sig_hash).

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgp_j4YFvzLEv.pgp
Description: PGP signature