linux-kernel - Re: kernel.org status: establishing a PGP web of trust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m3mxdbxkf4.fsf@intrepid.localdomain>
Date:	Sat, 08 Oct 2011 23:06:39 +0200
From:	Krzysztof Halasa <khc@...waw.pl>
To:	Jon Masters <jonathan@...masters.org>
Cc:	Valdis.Kletnieks@...edu, Adrian Bunk <bunk@...sta.de>,
	"Frank Ch. Eigler" <fche@...hat.com>,
	"H. Peter Anvin" <hpa@...or.com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Greg KH <gregkh@...e.de>
Subject: Re: kernel.org status: establishing a PGP web of trust

Jon Masters <jonathan@...masters.org> writes:

> One reason I stopped doing keysigning parties is that I
> realized they were mostly a show. You turn up and get a key signed and
> then everyone is impressed that you're in the strong set...wupdedoo.

I think there are other weaknesses than those. Examples:
- people checking the fingerprints on the keyserver, then getting the
  keys later and signing without checking the fingerprints again (the
  fingerprint may "change"),
- people sending the public key through email etc., and signing the key
  without checking (the key may change in email).

Especially in a situation like this one, when a key signing activity is
expected, people MUST check the fingerprint against the authenticated
one WHILE signing the key. It's probably more important that the very
careful check of ID authenticity (watermarks etc).

I'd be only a little surprised if some key signing fraud resulting in
kernel.org access attempt or something similar is detected soon.

> Not
> that I've anything against signing stuff on kernel.org and trying to
> improve things (I've long directly signed everything on master with my
> own keys in slight violation of policy, but that turned out to right).

At first I thought you meant signing with your private key on master :-)
-- 
Krzysztof Halasa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/