| |||||||||||||
|
| |||||||||||||
Closing the window of attackClosing the window of attackPosted Aug 29, 2008 9:14 UTC (Fri) by pragmatine (guest, #39557)In reply to: Closing the window of attack by tialaramex Parent article: The proposed Fedora key-migration plan
that assumes the passphrase of the old key hasn't already been cracked though. if it has all bets are off.
(Log in to post comments)
Closing the window of attack Posted Aug 29, 2008 23:10 UTC (Fri) by Sutoka (guest, #43890) [Link]
For an administrator, if the password of the key has already been cracked then you should try to verify the new key from as many different sources as possible first.
It's also possible the key *wasn't* stolen, and that this is just a precautionary measure to make sure the packages signed by the attacker don't get installed on the user's system as if they were valid.
I wonder if there's a version of the fedora-release package signed with the new key, allowing the admin to first install the key manually then use the newer version of the RPM (thus not having to trust the old key at all).
In the future, Fedora might wanna have multiple keys. One *normal* key they do all their signing with (like now), then another emergency key in case, well, this happens. The emergency key's only purpose would be to make it easier to replace the standard key (i.e. this fedora-release package would be signed with the emergency key). Obviously Fedora would want to make sure the key was encrypted and not stored somewhere that it'd be inconvenient to get to (preferably not accessible by a computer).
Closing the window of attack Posted Aug 30, 2008 0:02 UTC (Sat) by bojan (subscriber, #14302) [Link]
> In the future, Fedora might wanna have multiple keys.
If Fedora packages were signed by multiple independent signatories, yum could be designed to accept (for instance) only packages signed like this:
- Fedora key
or
- 5 keys from independent signatories
In that case, a compromise of a single key would be easily avoided, as long as you had enough signatories in the pool to make up the numbers (and with vast number of people involved in Fedora, this is definitely possible).
|
|
||||||||||||