Bwahaha...

Bwahaha...

Posted Feb 2, 2010 15:50 UTC (Tue) by khim (subscriber, #9252)
In reply to: Security in the 20-teens by joey
Parent article: Security in the 20-teens

Of course there is at least one VCS that does not rely on hashing for security, and instead relies on gpg signatures.

...which rely on the hashing for speed: typical GPG signature signs not the message itself but the hash of the message! This makes it potentially more vulnerable not less. The rest of the message is moot point.

Sure it may be good idea to use GPG signatures as defence from other attack vectors, but to say that GPG signatures can be used as defense against hash collisions... it's the height of folly.

---

(Log in to post comments)