From: Robert Buchholz <rbu@gentoo.org>
To: gentoo-scm@lists.gentoo.org
Cc: "Robin H. Johnson" <robbat2@gentoo.org>
Subject: Re: [gentoo-scm] gpg signing of commits, was: Progress summary, 2009/06/01
Date: Tue, 9 Jun 2009 03:50:35 +0200 [thread overview]
Message-ID: <200906090350.43278.rbu@gentoo.org> (raw)
In-Reply-To: <20090605185416.GB22927@orbis-terrarum.net>
[-- Attachment #1: Type: text/plain, Size: 2239 bytes --]
On Friday 05 June 2009, Robin H. Johnson wrote:
> On Fri, Jun 05, 2009 at 02:59:18PM +0200, Robert Buchholz wrote:
...
> > 2. It is not well designed (cryptographically)
> > OpenGPG allows the usage of a set of cryptographic hash function to
> > sign a document. This allows people to switch to a different
> > function once attacks against one algorithm become known. This has
> > been recently seen with SHA-1:
> > http://www.debian-administration.org/users/dkg/weblog/48
>
> I only stated that we need to offer GPG signing of commits. I did NOT
> specify the content of commits, other than noting that the commit
> message and the content needs to be signed together.
I don't think I understood what you meant to say, sorry. As I understand
the current proposal, it would be over the SHA-1 of the objects, the
parent and the commit message.
> > The git signing, however, relies on the collision resistance of
> > SHA-1 as that algorithm is used to identify objects in the
> > repository. We cannot migrate away from it easily. This has been
> > discussed upstream at length and Linus pointed out that 'the
> > "signed tags" security does depend on the hashes being
> > cryptographically strong.':
> > http://thread.gmane.org/gmane.comp.version-control.git/26106/focus=
> >26125
>
> The collision is going to come along anyway.
>
> Resigning would have to be done regardless of what we sign in Git.
> Not sure if you followed more recent discussions than one in 2006.
> The entire Git foodchain will suffer when it comes time to migrate
> away from SHA-2. Presently discussions of it imply that it's to be
> done probably as a versioned change, after the NIST hash competition
> comes up with a viable answer.
I have not seen any statements that would indicate they intended to
switch ever, do you have a reference? I only found discussions as
recent as April 2008. If it will be possible to use one (at that time)
stronger hash function, my argument is defeated. I wanted to point out
that right now they only support one function that is increasingly
weakened, and I have the feeling upstream will only act once collisions
become practical, which is -IMHO- too late.
Robert
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
next prev parent reply other threads:[~2009-06-09 1:50 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-06-01 23:45 [gentoo-scm] Progress summary, 2009/06/01 Robin H. Johnson
2009-06-05 12:59 ` [gentoo-scm] gpg signing of commits, was: " Robert Buchholz
2009-06-05 18:54 ` Robin H. Johnson
2009-06-09 1:50 ` Robert Buchholz [this message]
2009-06-09 2:46 ` Robin H. Johnson
2009-06-07 22:18 ` [gentoo-scm] " Donnie Berkholz
2009-06-07 22:27 ` Nirbheek Chauhan
2009-06-09 19:42 ` [gentoo-scm] New hooks for git, was: " Arun Raghavan
2009-06-09 20:16 ` Robin H. Johnson
2009-08-27 22:59 ` [gentoo-scm] Progress summary, 2009/08/27 Robin H. Johnson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200906090350.43278.rbu@gentoo.org \
--to=rbu@gentoo.org \
--cc=gentoo-scm@lists.gentoo.org \
--cc=robbat2@gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox