Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: flux <flux AT sourcemage.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Tue, 13 Dec 2011 18:11:33 +0900

Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
> Signatures are inherently more complicated, and in the way we use them
> don't add any extra security. Also, signing big files is expensive.
>
> Signing is, if I understand correctly, just computing the hashes, and
> encrypting the result of the set.

No, signing is *not* just computing hashes and encrypting the set.
Signing has nothing to do with hashing.

> So if we just save the hashes separately and sign that file, it would
> have a similar effect. We should also think about allowing several
> signatures.

No, it really wouldn't. You're missing the entire point of signing.

Signing is never equivalent to hasing. I've already explained this point
in this thread, and there's plenty of resources on the web discussing
both.

--
Justin "flux_control" Boffemmyer
Cauldron wizard and general mage
Source Mage GNU/Linux
http://www.sourcemage.org

Attachment: pgpaLSiW31j1D.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page