[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 31 Aug 2018 11:52:16 -0400
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: zugtprgfwprz@...rnkuller.de, oss-security@...ts.openwall.com
Subject: Re: Travis CI MITM RCE
On Thu 2018-08-30 18:13:34 +0200, zugtprgfwprz@...rnkuller.de wrote:
> I agree about the "key ID" part, but not about the "fingerprint" part.
> Pinning a cryptographic hash over a public key isn't a security
> antipattern by any strech of the imagination. Sure, you could argue that
> the SHA-1 used by GPG isn't state-of-the-art anymore, but we're not
> talking about collision attacks, but second preimage attacks. Far worse
> for the attacker.
>
> The way you phrased it, however, all applications of fingerprints/hashes
> would be broken (SSH fingerprints, HPKP, etc.), regardless of the hash
> function they use.
sorry, i think i wasn't clear enough about my complaint. I'm not
claiming that fingerprints are broken, or that second preimage attacks
against sha-1 are possible today. I'm saying that they're ill-suited to
many of the specific use cases where they show up.
If all i send you is a fingerprint, you *still* need to get the public
key somewhere. This is a point of potential failure.
In nearly every case where we're talking about automated signature
checking, the cost of shipping the public key instead of (or in addition
to) the fingerprint is negligible. and shipping just the fingerprint
introduces robustness and reliability problems for the signature
verification.
This is not to say that these sorts of things shouldn't consider looking
for updates to the keys that they have -- revocation checks, new
subkeys, etc all might be useful in some contexts. But there's no good
reason to ship a sophisticated, signature-verifying package with just a
fingerprint in it, when you could ship the whole key instead.
so, where are fingerprints useful? they're useful in *extremely
bandwidth-limited* cases, such as situations dealing with human
attention spans (e.g. fingerprint verification) or technically or
socially constrained channels like twitter, visible e-mail .signatures,
or SMS. They're also useful internally in programs that deal with many
keys, as concise references to known keys, or placeholders for unknown
keys.
Fingerprints are even arguably too long for most human attention spans,
so we need additional user research to look into better ways to do
verification that involves humans.
--dkg
Download attachment "signature.asc" of type "application/pgp-signature" (228 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
