Timeline for How safe are signed git tags? Only as safe as SHA-1 or somehow safer?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 3, 2017 at 8:30 | comment | added | hasufell | Linus is wrong and Wikipedia is right on this one. Cryptography is only as strong as its weakest link and in git, you're not signing the state of your repository, but something that refers to the state via SHA-1. That's pretty simple and a very obvious misdesign. | |
| Feb 24, 2017 at 18:46 | comment | added | fuzzyTew | Mike Gerwitz implies a repository may be trusted if every single commit is signed. He doean't address if this secures non-commit objects such as blob and tree, and he ignores that repos may have more-easily-attackable binary data committed to them. | |
| Feb 23, 2017 at 21:12 | answer | added | Peter Green | timeline score: 0 | |
| Feb 23, 2017 at 20:39 | comment | added | Ajedi32 | Linus actually did admit that signed tags are a bit of an exception: "The one exception: the "signed tags" security does depend on the hashes being cryptographically strong. So again, breaking SHA-1 would not mean that git stops working, but it would potentially mean that if you don't trust your own private repository, the signed tag may no longer protect you entirely" (See spinics.net/lists/git/msg09588.html) | |
| Nov 30, 2015 at 14:59 | history | edited | adrelanos | CC BY-SA 3.0 |
added 29 characters in body
|
| Jan 7, 2015 at 22:26 | comment | added | adrelanos | I don't mind either way. | |
| Jan 7, 2015 at 19:09 | comment | added | Caleb | See also the wording of my similar question. Since it has been closed as a duplicate would you ming if I edited in some of the more specific angles into this question? | |
| Sep 23, 2014 at 22:31 | history | edited | adrelanos | CC BY-SA 3.0 |
added 264 characters in body
|
| Sep 23, 2014 at 22:31 | comment | added | adrelanos | Got an verbose answer from Mike Gerwitz, the author of A Git Horror Story: Repository Integrity With Signed Commits: whonix.org/forum/index.php/topic,538.msg4278.html#msg4278 | |
| Sep 23, 2014 at 4:40 | answer | added | user10008 | timeline score: 22 | |
| Sep 22, 2014 at 18:37 | answer | added | smrt28 | timeline score: 7 | |
| Sep 22, 2014 at 15:23 | history | tweeted | twitter.com/#!/StackSecurity/status/514072597341167616 | ||
| Sep 22, 2014 at 14:27 | history | edited | adrelanos | CC BY-SA 3.0 |
added 105 characters in body
|
| Sep 22, 2014 at 13:55 | history | edited | Xander | CC BY-SA 3.0 |
Fixed links per OP request.
|
| Sep 22, 2014 at 13:50 | history | asked | adrelanos | CC BY-SA 3.0 |