[gentoo-dev] on the matter of security and cryptography

[Spider]

Well, I was browsing around the other day checking into the "behind the
scenes" work of gnupg and keyservers when I stumbled on this link..


http://www.cryptnet.net/fdp/crypto/strong_distro.html


Could you please take the time to read this and then consider:

What would be the requirements to getting this into our current system
without breaking backwards compability?

How do we do it to enforce "minimum developer effort"

What other infrastructure tools would be necessary?

and, how would we go about setting up a key-ring for Gentoo linux
developers who are completely unable to meet up in large quantities? 

its a difficult concept and hard to do while maintaining security for
all involved parties.



What I see here as some ideas are.: 
*) gpg is included as a base dependency for the system and included on
default bootdisks...

*) gpg import is done at "rsync" and the public keyring is avaiable on
rsync servers (better ideas people?)

*) gpg hash/checksum is done on the .ebuild, tarball and patches that
are avaiable through portage. (stored in digest)

*) all developers keys are linked in a keyring.


Now, all this is just stalling, it will be quite difficult to get all
the complex aspects of this "safe" into portage, so this will require
very very careful design before we start coding. having a rapid
development language is no excuse for a crappy design solution in this
case.

Key security is always an issue and a weak point when it comes to
developing software. acknowledged.

how do we avoid infringment into the keys (unauthorized keys added?) and
thus enabling an attacker to sign the modified ebuilds/patches and have
them check as clean?

we need to implement hashes for all patches and included files as well,
not only for tarballs. since if the patch is applied, it doesn't matter
if the tarball was ok, the system is flawed.

we need to do all this with as little user intervention as possible.

Now, this is cc'd to -dev as I think it should be in the open, its a
proposal and the time for discussion, and a following idea discussion
could do well in a larger community. we do have some bright minds, and
now is the time for even those who cannot code to come with ideas and
insights, because nothing goes into code, just yet.


Regards,
  Spider



--
begin  .signature
This is a .signature virus! Please copy me into your .signature!
See Microsoft KB Article Q265230 for more information.
end