On Thu, 25 Feb 2016, Dennis Gilmore wrote:
No one has access to the private key. It lives on a server that has no services running that listen for connections. There is a service that runs on it that talks to the signing bridge. That brokers all requests. Users with access do not know the password to unlock the key. The signing server manages access. There is exactly two copies of the private key, one embeded in encrypted storage on the signing server and a backup of the encrypted storage on the backup server. It has been designed to allow the granting and revocation of access without the need for having a copy of the private key.
https://fedorahosted.org/sigul/ is the software we use
Dennis
Thank you for providing this valuable information about the handling of the private key that enables Fedora ISO signing. This information should be shared and highlighted as it is helping to create trust in the use of this key. As a personal request, would you be so kind as to confirm the fingerprint here (and maybe somewhere else), please. Thank you very much.
Ralf
On Thursday, February 25, 2016 08:05:59 PM Ralf Senderek wrote:
On Thu, 25 Feb 2016, Dennis Gilmore wrote:
No one has access to the private key. It lives on a server that has no services running that listen for connections. There is a service that runs on it that talks to the signing bridge. That brokers all requests. Users with access do not know the password to unlock the key. The signing server manages access. There is exactly two copies of the private key, one embeded in encrypted storage on the signing server and a backup of the encrypted storage on the backup server. It has been designed to allow the granting and revocation of access without the need for having a copy of the private key.
https://fedorahosted.org/sigul/ is the software we use
Dennis
Thank you for providing this valuable information about the handling of the private key that enables Fedora ISO signing. This information should be shared and highlighted as it is helping to create trust in the use of this key. As a personal request, would you be so kind as to confirm the fingerprint here (and maybe somewhere else), please. Thank you very much.
Which fingerprint? There is a number of keys
Dennis
On Thu, 25 Feb 2016, Dennis Gilmore wrote:
Which fingerprint? There is a number of keys
Dennis
The one you were referring to in your posting and which an ordinary user would verify with:
gpg --list-keys --fingerprint 81B46521
Ralf
PS: if you had a long-term signing key it would be its fingerprint.
On Thursday, February 25, 2016 09:29:26 PM Ralf Senderek wrote:
On Thu, 25 Feb 2016, Dennis Gilmore wrote:
Which fingerprint? There is a number of keys
Dennis
The one you were referring to in your posting and which an ordinary user would verify with:
gpg --list-keys --fingerprint 81B46521
Ralf
PS: if you had a long-term signing key it would be its fingerprint.
We have no long term signing key, no way to cross sign the keys, I was referring to them all in general, not just one in particular.
Dennis
On Thu, Feb 25, 2016 at 08:05:59PM +0100, Ralf Senderek wrote:
Thank you for providing this valuable information about the handling of the private key that enables Fedora ISO signing. This information should be shared and highlighted as it is helping to create trust in the use of this key.
Where should this information be provided?
As a personal request, would you be so kind as to confirm the fingerprint here (and maybe somewhere else), please. Thank you very much.
What would be proper other places to confirm the fingerprint?
Regards Till
What would be proper other places to confirm the fingerprint?
The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information
Hope that helps to find such places.
On Mon, Mar 07, 2016 at 08:32:05AM -0000, Ralf Senderek wrote:
What would be proper other places to confirm the fingerprint?
The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information
We could possibly add it somewhere on a Red Hat site, which I think would fit all of these criteria in many people's eyes. Since it's entirely separate infrastructure from Fedora's websites, that would significantly raise the bar for any targetted website hacking.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
Somewhere like archive.org too maybe -- again totally separate inrastructure + it could be used as a un-official 'official' hash vault for checking.
On 03/07/2016 08:27 AM, Matthew Miller wrote:
On Mon, Mar 07, 2016 at 08:32:05AM -0000, Ralf Senderek wrote: >>> What would be proper other places to confirm the fingerprint? >>
The following criteria might be reasonable: >> - a place that has authority, that people might trust. >> - a place that is hard to impersonate, that has some protection >> against unauthorized use
- a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable
information > > We could possibly add it somewhere on a Red Hat site, which I think > would fit all of these criteria in many people's eyes. Since it's > entirely separate infrastructure from Fedora's websites, that would > significantly raise the bar for any targetted website hacking. >
On 7 March 2016 at 01:32, Ralf Senderek fedora@senderek.ie wrote:
What would be proper other places to confirm the fingerprint?
The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information
Hope that helps to find such places.
Not really. Everything above is subjective. In the past, when I have looked for sites that meet such criteria no one agrees that the place meets such criteria.
We put it in redhat.com and people who hate corporations or that Red Hat sponsors this project assume that if Red Hat were paid enough money they would change the data any time.
We put it in archive.org and people wonder how we can tell it isn't impersonated by some other site or that someone else isn't changing it.
We put it in lwn.net and people wonder how they will know where to find it or why we didn't choose reddit/slashdot/etc/etc.
We get google to host it and people wonder all of the above.
On Mon, 7 Mar 2016, Stephen John Smoogen wrote:
Hope that helps to find such places.
Not really. Everything above is subjective. In the past, when I have looked for sites that meet such criteria no one agrees that the place meets such criteria.
We put it in redhat.com and people who hate corporations or that Red Hat sponsors this project assume that if Red Hat were paid enough money they would change the data any time.
We put it in archive.org and people wonder how we can tell it isn't impersonated by some other site or that someone else isn't changing it.
We put it in lwn.net and people wonder how they will know where to find it or why we didn't choose reddit/slashdot/etc/etc.
We get google to host it and people wonder all of the above.
Stephen,
please bear in mind that it's not a measure to make everyone happy, publishing the fingerprint(s) is meant to prevent faking of the key. And this is much more than providing only self-signed keys without linking them to first-hand knowledge about their authenticity.
You don't have to come up with a solution that suits everyone, as long as it is enough to make faking a really hard job for anyone.
On Mon, Mar 7, 2016 at 8:27 AM, Stephen John Smoogen smooge@gmail.com wrote:
On 7 March 2016 at 01:32, Ralf Senderek fedora@senderek.ie wrote:
What would be proper other places to confirm the fingerprint?
The following criteria might be reasonable: - a place that has authority, that people might trust. - a place that is hard to impersonate, that has some protection against unauthorized use - a place that is visible to many people with a need to verify. - a place that is known for publishing cross-checked, reliable information
Hope that helps to find such places.
Not really. Everything above is subjective. In the past, when I have looked for sites that meet such criteria no one agrees that the place meets such criteria.
We put it in redhat.com and people who hate corporations or that Red Hat sponsors this project assume that if Red Hat were paid enough money they would change the data any time.
We put it in archive.org and people wonder how we can tell it isn't impersonated by some other site or that someone else isn't changing it.
We put it in lwn.net and people wonder how they will know where to find it or why we didn't choose reddit/slashdot/etc/etc.
We get google to host it and people wonder all of the above.
Get them all to host it. That oughta bypass any tomfoolery.