[gentoo-dev] Re: [gentoo-core] on the matter of security and cryptography

[Spider]

begin  quote
On Sun, 4 Aug 2002 19:11:35 +0200 (CEST)
"Maik Schreiber" <blizzy@g.o> wrote:

>
> > how do we avoid infringment into the keys (unauthorized keys added?)
> > and
>
> We don't need to.


 
> > thus enabling an attacker to sign the modified ebuilds/patches and
> > have them check as clean?
>
> Isn't that the whole point of signatures? You can fake them unless you
> have the private key. There's no need to block out other keys in the
> keyring if we check for The Right Ones (tm).
>


Okay, Both of theese questions come down to one thing: Key management.

no, we need to avoid infringement into the keys. concept:
cracker gets my box, keylogs and gets my key's password (or bruteforces
it). then he uses my key to sign his own replacement key, adds that to
the keyring and has his part set.  

all this should be quite simple to do without actually harming enough or
hampering enough to be detected in a system. 

after this, he only needs to slowly hack into one or five -system
builds, and either use my key, or the new fake one, to go ahead and
smash things. wham, haxor karma.


that was the sort of faked signatures I was counting for.

to have the revocation signatures spread out among the (senior?)
developers and allowing them to revoke others keys would be necessary
for security, but that still would not help with his newly generated key
thats released in mine (or drobbins?) name. 


so yes, this would require a whole different layer of security for the
developers to follow.  and can that be enforced?


Now that I think of it in theese terms, public keys should not be
distributed with the rsync servers, but only with the iso's and
downloaded from keyservers. 


//Spider

--
begin  .signature
This is a .signature virus! Please copy me into your .signature!
See Microsoft KB Article Q265230 for more information.
end