[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54F5D5EB.3020406@redhat.com>
Date: Tue, 03 Mar 2015 08:40:27 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: validation on update
On 03/03/15 03:32 AM, gremlin@...mlin.ru wrote:
> On 2015-03-02 19:24:30 +0000, Simon McVittie wrote:
> > An end-to-end integrity check from the original publisher to
> > the consumer would prevent more attacks, but would also be
> > harder to deploy (it requires action from each publisher,
>
> Running `gpg --detach-sign < package.tar.gz > package.tar.gz.sig`
> (or, better, `gpg -ba ...`) on each release isn't a big deal...
>
> > verification at each consumer,
>
> Running `gpg --verify package.tar.gz.sig package.tar.gz` will do
> that just perfectly. And, when talking about automatic updates,
> that should be included into the update procedure.
>
> > and a way to determine whether publisher X is authorized to
> > publish package Y);
>
> `gpg --no-default-keyring --keyring /path/authors.pub --verify ...`
No but key distribution and management is a real problem. How does
upstream sign all these things securely but also conveniently on their
end? How do they store the key (Hardware Security Module?). How does
upstream distribute the key (just HTTPS website? in the maven source?
hope nobody spoofs them.
There's a simple reason most projects don't sign software, key
management is such a pain (how do you security backup something that
should only exist in one spot? Encrypt it? Ok how do you secure that
key... Not saying it shouldn't be done, but just pointing out it's a
little more work than running "gpg --sigh".
Does anyone have any good guidelines/procedure docs on this stuff? E.g.
which HSM devices support GPG, etc?
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
