From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1Ttlcp-0006S8-SE for mharc-grub-devel@gnu.org; Fri, 11 Jan 2013 15:54:51 -0500 Received: from eggs.gnu.org ([208.118.235.92]:49444) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Ttlcf-0006PV-1T for grub-devel@gnu.org; Fri, 11 Jan 2013 15:54:50 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TtlcW-0004cP-KX for grub-devel@gnu.org; Fri, 11 Jan 2013 15:54:40 -0500 Received: from mail-we0-f179.google.com ([74.125.82.179]:43613) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TtlcW-0004cL-D3 for grub-devel@gnu.org; Fri, 11 Jan 2013 15:54:32 -0500 Received: by mail-we0-f179.google.com with SMTP id r6so1029644wey.38 for ; Fri, 11 Jan 2013 12:54:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :x-enigmail-version:content-type; bh=YOIhVttPnBlox96Hzy9IJOzLUJrxmdfxAdkS776eKLM=; b=blYVXCPaPNe2xvmDlWvNyGG1CBZZZjvP1idcJryTR92/4nvVO95Tc0wG0DzSR7HEE5 5H/NtQz8txNIOdm/DvuUC0CLebAXYC3GyBPG9J25Z/CL3lYVHOBK5Zh6vIaKTZlclftt sUlX1zSXGWrHHpCr/7vpMrv5EwT/wx6PLfGBQcCTSnTXhsmfdG8gZmD83Wr1IzB7AdFh tMpHxbTausCFGVAuEGuUDHRXAggW9ATCQLG5/GuuUJ48n/BiJJ4ciAXYm6+TaoIavlcQ 6GLvnd0d7c4FhwoqST5FSwHQ4wyugd2qE9wC8OtxdG77oTNdtbEhvqZ+edAheMJWZug2 XDNA== X-Received: by 10.180.84.193 with SMTP id b1mr853521wiz.26.1357937670947; Fri, 11 Jan 2013 12:54:30 -0800 (PST) Received: from debian.x201.phnet (127-197.203-62.cust.bluewin.ch. [62.203.197.127]) by mx.google.com with ESMTPS id h19sm775269wiv.7.2013.01.11.12.54.29 (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 11 Jan 2013 12:54:29 -0800 (PST) Message-ID: <50F07BFE.4050800@gmail.com> Date: Fri, 11 Jan 2013 21:54:22 +0100 From: =?UTF-8?B?VmxhZGltaXIgJ8+GLWNvZGVyL3BoY29kZXInIFNlcmJpbmVua28=?= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:10.0.11) Gecko/20121122 Icedove/10.0.11 MIME-Version: 1.0 To: The development of GRUB 2 Subject: DSA GnuPG signatures X-Enigmail-Version: 1.4.1 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="------------enig0204BAEDF2CAA77DC0A0A45C" X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [fuzzy] X-Received-From: 74.125.82.179 X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 11 Jan 2013 20:54:50 -0000 This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enig0204BAEDF2CAA77DC0A0A45C Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, all. I've just committed import of libgcrypt and implementation of related code to check signatures. Short usage: verify_detached FILE FILE.sig [pubkey.gpg] trust KEY.gpg distruct KEYID check_signatures=3D[enforce|no] grub-mkimage -k KEY gcry_dsa verify [...] When check_signatures=3Denforce every time anthing tries to open a file its signature (file.sig) is looked for and the open fails if signature is absent or invalid. Some limitations: 1) DSA keys only. RSA is more tricky since it needs padding and RSA should be progressively phased out, not put into new places due to some vulnerabilities (large classes of semiprimes are factorisable up to the point when a lot of care has to be taken to avoid them). 2) Not efficient. Checking every file is slow. Some hashlists should be implemented. 3) Not efficient. File is read twice though it's avoidable in many cases.= --=20 Regards Vladimir '=CF=86-coder/phcoder' Serbinenko --------------enig0204BAEDF2CAA77DC0A0A45C Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREKAAYFAlDwe/8ACgkQNak7dOguQglXIgD+JfUdUs8D7B1yT1ZUkR/nSrV5 OMZYysjKgSPvtWEhIIYA/iltVnoOPm7fTFGipogGXg8JNKT6sU8QwG2YQw7kpW3s =H7Qb -----END PGP SIGNATURE----- --------------enig0204BAEDF2CAA77DC0A0A45C--