Skip to Content.
Sympa Menu

sm-security - Re: [SM-Security] openPGP security by signing

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: Seth Woolley <seth AT tautology.org>
  • Cc: sm-security AT lists.ibiblio.org
  • Subject: Re: [SM-Security] openPGP security by signing
  • Date: Thu, 15 May 2003 09:42:14 -0400



Seth Woolley wrote:


1) 40 sources or just use regular MD5s. (two for each source, one for the
original file, second for the detached signature).
For the ones with lots of patches, when you add gpg to it, you just
renumber them 1, 2, 3 would be 1, 3, 5 with 2, 4, 6 being the respective
signature files.

This will get us nowhere. It's not that your idea is faulty, it's that entire MD5[x] business. It ould be better to use some variable, say VERIFY, with a predefined format which would be, say, MD5:576576...78576 or something lese for the GPG., like GPG:URL-of-the-signature.


2) all MD5 sources that choose not to use gpg checking will require no
modifications. For those that do provide gpg signatures, you just do what
I said in answer 1), and then make sure that the additional args are
passed to unpack as $3 and $4.


would look like:

==>
unpack $SOURCE ${MD5[0]} $SOURCE2 ${MD5[1]} &&
unpack $SOURCE3 ${MD5[2]} $SOURCE4 ${MD5[3]}
<==

Again, it's not your fault, but doesn't this indexing look like asking for trouble more than anything else?

I think we need not rush into this and maybe rethink the MD5 idea better.

Sergey.





Archive powered by MHonArc 2.6.24.

Top of Page