Public SourceMage Discussion List

[flux <flux AT sourcemage.org>]

Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
> Signatures are inherently more complicated, and in the way we use them
> don't add any extra security. Also, signing big files is expensive.
> 
> Signing is, if I understand correctly, just computing the hashes, and
> encrypting the result of the set.

No, signing is *not* just computing hashes and encrypting the set.
Signing has nothing to do with hashing.

> So if we just save the hashes separately and sign that file, it would
> have a similar effect. We should also think about allowing several
> signatures.

No, it really wouldn't. You're missing the entire point of signing.

Signing is never equivalent to hasing. I've already explained this point
in this thread, and there's plenty of resources on the web discussing
both.

-- 
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpaLSiW31j1D.pgp
Description: PGP signature