Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] openPGP security by signing

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] openPGP security by signing
  • Date: Wed, 14 May 2003 21:30:02 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Wed, 14 May 2003, Sergey A. Lipnevich wrote:
> Seth Woolley wrote:
>
> >they can't trojan another spell). I want people who cast sendmail to be
> >trusting sendmail, not joe blow whose key we happened to sign since he has
> >a spell in our grimoire.
> >
> >
> >
> Let me make sure I understand this. Are you saying that the trust to the
> original package should extend to our spell? That's impossible AFAICT.
> Neither Sendmail nor Apache nor many other teams who provide gpg
> signatures will not agree to sign our spells' code. Moreover, our spell
> may be harmful while the package is not, and vice versa. So, I don't
> understand the statement above that you made. Could you please clarify?
>
> Sergey.

Funny how it may seem like I said that, but good thing that I didn't. ;)
I just mean that we would confirm the source was good if three conditions
were met:

the source was signed by sendmail
the sendmail key is signed directly by our private key
the sendmail key fingerprint matches the fingerprint given in the sendmail
spell.

That means that our signing sendail's key with a signature from us is
limited to successfully working on the sendmail spell because the spell
has the fingerprint of the only key it will allow to check that specific
source associated to the source file in DETAILS.

Just means that the samba people can't sign a sendmail tarball and have it
get accepted by our checker just because we signed it for our samba spell.
That means that "cast sendmail" trusts sendmail, not samba.

>
> BTW, linux spell signature checking is an awesome example, really cool.
>

Thanks. ;) It was me bugging W0rf and him saying "I can't store 1000 MD5s
in the spell!"... he finally said, "but they have a pgp key..." and so I
said, since I was hammering on him so much, I'd implement it.

Hope that explains everything, though.

Seth

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org and pgp.mit.edu. info: www.gnupg.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+wxfc7fQ833vqzH0RAqXqAKClotClqC2uKMcMVcm6BzkmQoui9ACeIPib
vUknAOKPYf+h/M7VKMRRoPA=
=s9Cc
-----END PGP SIGNATURE-----





Archive powered by MHonArc 2.6.24.

Top of Page