From: "\"Paweł Hajdan, Jr.\"" <phajdan.jr@gentoo.org>
To: gentoo-project@lists.gentoo.org
Subject: Re: [gentoo-project] let's stop using short gpg key ids, that's insecure
Date: Thu, 05 Jan 2012 18:57:35 +0100 [thread overview]
Message-ID: <4F05E48F.3040802@gentoo.org> (raw)
In-Reply-To: <20120102181752.27c70a7f@pomiocik.lan>
[-- Attachment #1: Type: text/plain, Size: 662 bytes --]
On 1/2/12 6:17 PM, Michał Górny wrote:
> Insecure to what?
It's easy to confuse keys that way. I'm not saying that it results in an
immediate compromise or that it's urgent, but if we can make it harder
to confuse keys, why not do that?
> The trust model of PGP is not based on key
> IDs. The short IDs are only used to let users grab our keys at will;
> and as the blog post shows, GPG handles repeating key IDs just fine.
Do all developer keys have at least one signature of some other key? In
the absence of signatures (and how does the user verify that those have
been made by developers?), what users have is our list of short key IDs.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 203 bytes --]
next prev parent reply other threads:[~2012-01-05 17:58 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-02 14:47 [gentoo-project] let's stop using short gpg key ids, that's insecure "Paweł Hajdan, Jr."
2012-01-02 15:20 ` Chí-Thanh Christopher Nguyễn
2012-01-02 17:17 ` Michał Górny
2012-01-05 17:57 ` "Paweł Hajdan, Jr." [this message]
2012-01-05 18:21 ` Michał Górny
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F05E48F.3040802@gentoo.org \
--to=phajdan.jr@gentoo.org \
--cc=gentoo-project@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox