Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) Source code repositories (CVSweb) File archive & mirrors How to verify digital signatures OVE IDs What's new

Message-ID: <20110130185001.GA21765@openwall.com>
Date: Sun, 30 Jan 2011 21:50:01 +0300
From: Solar Designer <solar@...nwall.com>
To: owl-users@...ts.openwall.com
Subject: all new *.mtree files are now signed

Hi,

As some of you are aware, the *.mtree files for Owl trees distributed
via the FTP mirrors were always PGP-signed for Owl releases, but only
sometimes signed for Owl-current and -stable branch snapshots.  The
reason for this was that those snapshots were generated on a server,
which was unsuitable to upload our main signing key to (placing this key
at extra risk).

The obvious solution, which we've finally implemented today, was to
introduce a second keypair and use this one to sign the snapshot *.mtree
files.  The second public key is now available on the signatures page:

http://www.openwall.com/signatures/

It is called "Openwall GNU/*/Linux online signing key", and it is signed
with our main signing key.

The primary use for signatures made with the "online" key is for you to
be able to verify that your Owl downloads (which are typically made from
mirrors and via "insecure" protocols) haven't been tampered with as
compared to the files stored on our mirrors feed.  (For those familiar
with Linux kernel downloads from kernel.org, our "online" key is similar
to "Linux Kernel Archives Verification Key" in the way we're using it.)

The Owl-current snapshot currently on the mirrors feed (and already on
some mirrors) is signed with this key.

Since the intent is to always sign Owl snapshots from now on (in fact,
some of this is scripted), I've also updated the Owl upgrade
instructions with info on verifying the authenticity of downloads as an
"unconditional" step (previously, this was suggested as an option):

http://openwall.info/wiki/Owl/upgrade

As usual, any feedback is welcome.

Alexander

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.