Date: Tue, 03 Mar 2015 08:40:27 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: validation on update On 03/03/15 03:32 AM, gremlin@...mlin.ru wrote: > On 2015-03-02 19:24:30 +0000, Simon McVittie wrote: > > An end-to-end integrity check from the original publisher to > > the consumer would prevent more attacks, but would also be > > harder to deploy (it requires action from each publisher, > > Running `gpg --detach-sign < package.tar.gz > package.tar.gz.sig` > (or, better, `gpg -ba ...`) on each release isn't a big deal... > > > verification at each consumer, > > Running `gpg --verify package.tar.gz.sig package.tar.gz` will do > that just perfectly. And, when talking about automatic updates, > that should be included into the update procedure. > > > and a way to determine whether publisher X is authorized to > > publish package Y); > > `gpg --no-default-keyring --keyring /path/authors.pub --verify ...` No but key distribution and management is a real problem. How does upstream sign all these things securely but also conveniently on their end? How do they store the key (Hardware Security Module?). How does upstream distribute the key (just HTTPS website? in the maven source? hope nobody spoofs them. There's a simple reason most projects don't sign software, key management is such a pain (how do you security backup something that should only exist in one spot? Encrypt it? Ok how do you secure that key... Not saying it shouldn't be done, but just pointing out it's a little more work than running "gpg --sigh". Does anyone have any good guidelines/procedure docs on this stuff? E.g. which HSM devices support GPG, etc? -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ