Date: Fri, 31 Aug 2018 11:52:16 -0400 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: zugtprgfwprz@...rnkuller.de, oss-security@...ts.openwall.com Subject: Re: Travis CI MITM RCE On Thu 2018-08-30 18:13:34 +0200, zugtprgfwprz@...rnkuller.de wrote: > I agree about the "key ID" part, but not about the "fingerprint" part. > Pinning a cryptographic hash over a public key isn't a security > antipattern by any strech of the imagination. Sure, you could argue that > the SHA-1 used by GPG isn't state-of-the-art anymore, but we're not > talking about collision attacks, but second preimage attacks. Far worse > for the attacker. > > The way you phrased it, however, all applications of fingerprints/hashes > would be broken (SSH fingerprints, HPKP, etc.), regardless of the hash > function they use. sorry, i think i wasn't clear enough about my complaint. I'm not claiming that fingerprints are broken, or that second preimage attacks against sha-1 are possible today. I'm saying that they're ill-suited to many of the specific use cases where they show up. If all i send you is a fingerprint, you *still* need to get the public key somewhere. This is a point of potential failure. In nearly every case where we're talking about automated signature checking, the cost of shipping the public key instead of (or in addition to) the fingerprint is negligible. and shipping just the fingerprint introduces robustness and reliability problems for the signature verification. This is not to say that these sorts of things shouldn't consider looking for updates to the keys that they have -- revocation checks, new subkeys, etc all might be useful in some contexts. But there's no good reason to ship a sophisticated, signature-verifying package with just a fingerprint in it, when you could ship the whole key instead. so, where are fingerprints useful? they're useful in *extremely bandwidth-limited* cases, such as situations dealing with human attention spans (e.g. fingerprint verification) or technically or socially constrained channels like twitter, visible e-mail .signatures, or SMS. They're also useful internally in programs that deal with many keys, as concise references to known keys, or placeholders for unknown keys. Fingerprints are even arguably too long for most human attention spans, so we need additional user research to look into better ways to do verification that involves humans. --dkg Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.