21 Zář
2014
21 Zář
'14
7:25
Greetings
Regarding the gpg key used to sign http://deb.knot-dns.cz/debian/.
Any chance that that key could be available for downloaded by way of
https://, or perhaps just have its fingerprinted listed on
https://www.knot-dns.cz/pages/download.html?
While the https:// CA model is far from perfect it'd still like to think
it being a step up compared to regular http://, and at the same time a
lot easier to document than the process of following the signatures in a
gpg web of trust.
// Andreas
22 Zář
22 Zář
10:19
Hi Andreas,
the APT key is signed by my quite strongly trusted[1] GPG key:
$ gpg --list-sig ftpmaster(a)labs.nic.cz
pub 4096R/0xAC0E47584A7A714D 2014-09-09
Key fingerprint = DF3D 585D B8F0 EB65 8690 A554 AC0E 4758 4A7A 714D
uid [ full ] CZ.NIC Labs Archive Automatic Signing Key
<ftpmaster(a)labs.nic.cz>
sig 3 0xAC0E47584A7A714D 2014-09-09 CZ.NIC Labs Archive Automatic Signing Key
<ftpmaster(a)labs.nic.cz>
sig 3 0x0C99B70EF4FCBB07 2014-09-09 Ondřej Surý <ondrej(a)sury.org>
sub 4096R/0xC8206E73FE9AA2B3 2014-09-09
sig 0xAC0E47584A7A714D 2014-09-09 CZ.NIC Labs Archive Automatic Signing Key
<ftpmaster(a)labs.nic.cz>
We can get more developers to sign this Archive signing key,
but I think this is stronger assurance than unsigned server
content served by https://.
Anyway there's no problem publishing the fingerprint on the
webpage, so we'll do that anyway.
1. http://pgp.cs.uu.nl/stats/F4FCBB07.html
Cheers,
Ondrej
--
Ondřej Surý -- Chief Science Officer
-------------------------------------------
CZ.NIC, z.s.p.o. -- Laboratoře CZ.NIC
Americka 23, 120 00 Praha 2, Czech Republic
mailto:ondrej.sury@nic.cz http://nic.cz/
-------------------------------------------
----- Original Message -----
From: "Andreas Olsson"
<andreas(a)arrakis.se>
To: knot-dns-users(a)lists.nic.cz
Sent: Sunday, September 21, 2014 7:25:41 AM
Subject: [knot-dns-users] Debian archive signing key, available over https?
Greetings
Regarding the gpg key used to sign http://deb.knot-dns.cz/debian/.
Any chance that that key could be available for downloaded by way of
https://, or perhaps just have its fingerprinted listed on
https://www.knot-dns.cz/pages/download.html?
While the https:// CA model is far from perfect it'd still like to think
it being a step up compared to regular http://, and at the same time a
lot easier to document than the process of following the signatures in a
gpg web of trust.
// Andreas
_______________________________________________
knot-dns-users mailing list
knot-dns-users(a)lists.nic.cz
https://lists.nic.cz/cgi-bin/mailman/listinfo/knot-dns-users
11:06
mån 2014-09-22 klockan 10:19 +0200 skrev Ondřej Surý:
the APT key is signed by my quite strongly trusted[1]
GPG key:
...
We can get more developers to sign this Archive signing key,
but I think this is stronger assurance than unsigned server
content served by https://.
Anyway there's no problem publishing the fingerprint on the
webpage, so we'll do that anyway.
Thanks.
And yes, I agree that the gpg signature chain offers a potentially much
stronger level of assurance.
// Andreas
3639
days inactive
3640
days old
2 comments
2 participants
participants (2)
-
Andreas Olsson -
Ondřej Surý