3

I am about to decide what SHA-512 hash sum and / or GPG verification scheme I will choose.

Let me present you with two options:

  1. Signing the 25 GB ~ 23 GiB (one file fit to a Blu-Ray) directly with:

    $ gpg --local-user <my_gpg_fingerprint> \
          --sign --armor \
          --output       "${backup_file}.xz.enc.asc" \
          --detach-sign  "${backup_file}.xz.enc"
    

    which honestly takes a long time even on a higher-end laptop of mine; or

  2. Create SHA512SUM of that big encrypted file and sing that one with:

    $ sha512sum --binary "${backup_file}.xz.enc" > \ 
          "${backup_file}.xz.enc.SHA512SUM"
    
    $ gpg --local-user <my_gpg_fingerprint> \
          --sign --armor \
          --output       "${backup_file}.xz.enc.SHA512SUM.asc" \
          --detach-sign  "${backup_file}.xz.enc.SHA512SUM"
    

    which has actually proven to be way a little faster.


Please elaborate as to what security implications might the faster version have as a disadvantage to the direct signing the big file.


Benchmark

$ time gpg --personal-digest-preferences sha512 \
    --local-user <my_gpg_fingerprint> \
    --sign --armor \
    --output test_file_23gib_random_data.asc \
    --detach-sign test_file_23gib_random_data

result:

real    1m25,444s
user    1m17,059s
sys     0m4,728s

As opposed to signing the SHA-512 file:

$ time sha512sum --binary test_file_23gib_random_data > \
    test_file_23gib_random_data.SHA512SUM

result:

real    1m7,568s
user    1m2,810s
sys     0m4,567s

and signing it in ~ 0.4 seconds.


Final thoughts

So, there is a few seconds difference. Not really a big deal, but noticeable.

I am still interested in your view about the security implications, which this question was originally intended to be about.


Hardware:

  • Dell Inspiron 15 Gaming 7577, model number 7577-92774.

  • Processor: I have an Intel Kaby Lake CPU: Intel Core i7-7700HQ.

  • Storage: NVMe PCI-E drive.

System:

I am on Linux Mint 19.1; based on Ubuntu 18.04.

  • 1
    Exactly how much faster is sha512sum than signing? – AndrolGenhald Mar 14 at 20:29
  • You can’t compare the two methods, a signature can not be forged and checksum can. For download verification or when you can transport the checksum safely you don’t need signatures. Or you can pgp sign the checksum file. Since pgp does not much more than calculating the checksum your binary might not be optimized (or at the end of the hashing your random source was slow) – eckes Mar 15 at 2:52
  • @eckes I don't fully understand your comment. I did present you with option 2, which is exactly as you say: "Or you can pgp sign the checksum file.". Please explain your idea more in-depth please. Thank you. – Vlastimil Mar 15 at 4:55
  • @eckes PGP signs a digest, not the full file. So why can you forge a SHA512 checksum, but not a signature? – vidarlo Mar 15 at 15:50
  • @vidarlo If you want to change a checksumed File you would change it, checksum it and replace the shasum file with the new checksum. If somebody downloads both they won’t notice a mismatch. If the attacker tries to do that with the signature file they can’t because they don’t have the secret key to create a valid signature. – eckes Mar 15 at 21:18
3

Most signature schemes already require hashing the data as part of the signing operation. Adding another hash before this shouldn't really be necessary (ie this likely indicates a performance issue in gpg), but as long as the hash used is at least as strong as the one used for the signature it shouldn't result in a reduction in security.

There is a minor difference in that sha512sum will output the filename as well as the hash, so your signature will be over the filename as well as the data.

Note that gpg allows you to specify the hash function with --personal-digest-preferences or --digest-algo, so selecting a different hash may be an alternate solution to your problem.

  • I was unable to replicate the performance issue, so it may have to do with the architecture, compilation options, or gpg version used. – AndrolGenhald Mar 15 at 3:14
  • The fact that you're signing over the filename as well as the data could be considered and advantage, right?\ – Mike Ounsworth Mar 15 at 15:15
  • @MikeOunsworth It certainly could be, but I'm sure there also exist cases where you might want to be able to change the file name. Something to be aware of at least. – AndrolGenhald Mar 15 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.