linux-kernel - Re: email as a bona fide git transport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191018180026.GD25456@chatter.i7.local>
Date:   Fri, 18 Oct 2019 14:00:26 -0400
From:   Konstantin Ryabitsev <konstantin@...uxfoundation.org>
To:     Santiago Torres Arias <santiago@....edu>
Cc:     Vegard Nossum <vegard.nossum@...cle.com>, Willy Tarreau <w@....eu>,
        workflows@...r.kernel.org, Git Mailing List <git@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>, Eric Wong <e@...24.org>
Subject: Re: email as a bona fide git transport

On Fri, Oct 18, 2019 at 12:11:22PM -0400, Santiago Torres Arias wrote:
>> It's smaller, but it's not a one-liner. Here's a comparison using 
>> ED25519
>> keys of the same length:
>>
>> minisign:
>>
>> RWQ4kF9UdFgeSt3LqnS3WnrLlx2EnuIFW7euw5JnLUHY/79ipftmj7A2ug7FiR2WmnFNoSacWr7llBuyInVmRL/VRovj1LFtvA0=
>>
>> pgp:
>>
>> -----BEGIN PGP SIGNATURE-----
>>
>> iHUEARYIAB0WIQR2vl2yUnHhSB5njDW2xBzjVmSZbAUCXaniFAAKCRC2xBzjVmSZ
>> bHA5AP46sSPFJfL2tbXwswvj0v2DjLAQ9doxl9bfj9iPZu+3qwEAw5qAMbjw9teL
>> L7+NbJ0WVniDWTgt+5ruQ2V9vyfYxAc=
>> =B/St
>
>Yeah, the discrepancy mostly comes from pgp embedding a timestamp and a
>longer keyid (+a full keyid fingerprint in pgp 2.1+). Minisign keyids
>are 8 random bytes, apparently.
>
>It doesn't seem like an amazing win in terms of succintness, imvho...

There isn't, but ED25519 subkeys are still very rare among developers.  
Many have 4096-bit RSA subkeys, and you can imagine how large the sigs 
from those are.

I want to underline that my use of minisign was specifically for patches 
sent via email, without the intent of preserving them in git history 
(which is why in my proposal they are put under the `---` cutoff). Git 
itself would continue to use PGP signing.

(This also means that we don't necessarily need to make this a native 
part of git -- it can be accomplished by a combination of wrappers, 
git-format-patch parameters, and a pre-applypatch hook. However, the 
likelihood of adoption in this case would be very low.)

-K

Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)