|
Message-ID: <3e3fad60-244f-e11d-f3c9-4757be6e6f93@johannes-bauer.com> Date: Thu, 30 Aug 2018 18:13:34 +0200 From: zugtprgfwprz@...rnkuller.de To: oss-security@...ts.openwall.com Subject: Re: Travis CI MITM RCE Hi Daniel, On 28.08.2018 18:43, Daniel Kahn Gillmor wrote: > In some ways, the keyserver network has done the OpenPGP community a > disservice, by encouraging OpenPGP users to refer to keys by > fingerprints (or even worse, by key IDs). While this is a useful > shorthand in some contexts, it's really a security/reliability > anti-pattern when it comes to secure programming. I agree about the "key ID" part, but not about the "fingerprint" part. Pinning a cryptographic hash over a public key isn't a security antipattern by any strech of the imagination. Sure, you could argue that the SHA-1 used by GPG isn't state-of-the-art anymore, but we're not talking about collision attacks, but second preimage attacks. Far worse for the attacker. The way you phrased it, however, all applications of fingerprints/hashes would be broken (SSH fingerprints, HPKP, etc.), regardless of the hash function they use. Cheers, Joe t -- "A PC without Windows is like a chocolate cake without mustard."
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.