oss-sec mailing list archives
Re: Travis CI MITM RCE
From: Daniel Kahn Gillmor <dkg () fifthhorseman net>
Date: Fri, 31 Aug 2018 11:52:16 -0400
On Thu 2018-08-30 18:13:34 +0200, zugtprgfwprz () spornkuller de wrote:
I agree about the "key ID" part, but not about the "fingerprint" part. Pinning a cryptographic hash over a public key isn't a security antipattern by any strech of the imagination. Sure, you could argue that the SHA-1 used by GPG isn't state-of-the-art anymore, but we're not talking about collision attacks, but second preimage attacks. Far worse for the attacker. The way you phrased it, however, all applications of fingerprints/hashes would be broken (SSH fingerprints, HPKP, etc.), regardless of the hash function they use.
sorry, i think i wasn't clear enough about my complaint. I'm not claiming that fingerprints are broken, or that second preimage attacks against sha-1 are possible today. I'm saying that they're ill-suited to many of the specific use cases where they show up. If all i send you is a fingerprint, you *still* need to get the public key somewhere. This is a point of potential failure. In nearly every case where we're talking about automated signature checking, the cost of shipping the public key instead of (or in addition to) the fingerprint is negligible. and shipping just the fingerprint introduces robustness and reliability problems for the signature verification. This is not to say that these sorts of things shouldn't consider looking for updates to the keys that they have -- revocation checks, new subkeys, etc all might be useful in some contexts. But there's no good reason to ship a sophisticated, signature-verifying package with just a fingerprint in it, when you could ship the whole key instead. so, where are fingerprints useful? they're useful in *extremely bandwidth-limited* cases, such as situations dealing with human attention spans (e.g. fingerprint verification) or technically or socially constrained channels like twitter, visible e-mail .signatures, or SMS. They're also useful internally in programs that deal with many keys, as concise references to known keys, or placeholders for unknown keys. Fingerprints are even arguably too long for most human attention spans, so we need additional user research to look into better ways to do verification that involves humans. --dkg
Attachment:
signature.asc
Description:
Current thread:
- Travis CI MITM RCE Jakub Wilk (Aug 25)
- Re: Travis CI MITM RCE Phil Pennock (Aug 26)
- Re: Travis CI MITM RCE Jeremy Stanley (Aug 26)
- Re: Travis CI MITM RCE Daniel Kahn Gillmor (Aug 28)
- Re: Travis CI MITM RCE zugtprgfwprz (Aug 30)
- Re: Travis CI MITM RCE vines (Aug 31)
- Re: Travis CI MITM RCE zugtprgfwprz (Sep 01)
- Re: Travis CI MITM RCE Daniel Kahn Gillmor (Aug 31)
- Re: Travis CI MITM RCE zugtprgfwprz (Sep 01)
- Re: Travis CI MITM RCE Phil Pennock (Aug 26)