Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells
  • Date: Thu, 20 Jan 2005 18:26:47 -0800 (PST)

http://bugs.sourcemage.org/show_bug.cgi?id=8047





------- Additional Comments From acedit AT armory.com 2005-01-20 18:26 -------
Please dont misrepresent my words
"we probably do not need gpg signatures for sources"
is definitly NOT the same as
"the md5s alone are "relatively" secure as they are already under the blanket
of
the grimoire gpg signature"

There is a very big difference in those statements, the first essentially
nullifies this bug (why would i have filed it then?) and the second simply
says
that we dont need to switch all spells to gpg /right now/. I also did not say
that /all/ spells need to use gpg, but that it is a useful feature that spells
are encouraged to use, and as gpg signing becomes more popular and people
realize that bare checksumming is a very deficient form of verification (just
modify the checksum) we will be ahead of the game.

perforce and history files have nothing to do with this afiact...This is for
verification of source files and a more secure and robust replacement for our
md5 scheme. Anything to do with perforce and history files is out of the scope
of this enhancement. If you want to have a larger discussion about the merits
of
gpg vs md5 and why this is a seemingly useless enhancment that requires so
much
more of spell maintainers I would recommend it be taken to a more public forum
so as not to clutter up this bug where implementation details ought to be
discussed.

I said nothing about perforce and my comment on history files was related to
using history files for programmatic information gathering. Perforce as a
validation tool is a whole different problem.

Back to my (actual) comment. It is true that with grimoire signatures md5sums
will become more trusted (hence why thats a 1.12 feature and this is a 1.13
feature). However I dont think that we should stay with md5 forever, nor do I
think SHA1 is a robust and permanent solution.

You're welcome to disagree that gpg signatures dont enhance security over md5,
but im not seeing a lot of evidence for that statement. Certainly they can be
no
worse.

gpg requires more effort to subvert than our md5 setup, there are more things
one must do, the more things one has to do in order to break something the
better. This is why you have firewalls, chroot jails, daemons that drop
privaledges and secure kernels, not just one of those things.

There are some security problems that gpg can address that md5 cannot, and
there
are some problems neither of them solve. Its also important to note that well
signed sources require /less/ work on the part of the spell maintainer (but
are
more secure because the attacker has to forge the third party signature). This
feature is primarily addressed to those sources, and only secondarily to
sources
that arent signed and require this ever-so-difficult signature from a guru.
But
in either case this is not a completely useless waste of effort on the part of
spell maintainers as you seem to be implying. There ARE security benefits
which
IMO are far more robust than md5.

Furthermore md5 will be broken someday, other hashing algorithms could be
broken
too, gpg is more agile in that we can easily make bigger and better keys as
better algorithms come along with having to touch sorcery. Someone could break
dsa and we wouldnt have to touch a line of sorcery code. We effectively
offload
the innovation in verification to gnupg. gnupg becomes a generic solution to
the
verification problem. That makes it so we dont have to update sorcery every
year
or two when we want to use the next best hashing algorithm. IMO thats a very
good thing.

Gnupg will be part of basesystem in the future, Ive already requested it be an
optional_depends while I work on the 1.12 gpg features.

--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page