Re: [RFC] Authenticate push via PGP signature, not SSH

From: Shawn O. Pearce <spearce@spearce.org>
Date: Jan 31, 2008, 05:43 UTC
Message-ID: <20080131054304.GY24004@spearce.org>
In-Reply-To: <47A02EA8.50507@viscovery.net>

Johannes Sixt <j.sixt@viscovery.net> wrote:

Show 20 quoted lines

> Shawn O. Pearce schrieb:
> > I'm currently finishing a side-band-64k protocol extension to the
> > send-pack/receive-pack pair.  My next task after I flush those
> > RFC patches out to the list tonight will be to prototype at least
> > some of the auth1 extension I described.
> 
> I propose to make the syntax of the extension
> 
> server capability:  auth=<list of hash methods>:<challenge>
> client response:    auth=<chosen hash method>
> 
> where <challenge> is a random sequence of non-blank ASCII text, not
> necessarily of a fixed length, but perhaps of a minimum length.
> 
> Then we can extend the list of hash algorithms (that are used for
> authentication purposes) if people think that SHA1 is not secure enough:
> 
>     auth=SHA1,SHA256:random-stuff-goes-here
> 
> I'm not a security expert, so take this with a grain of salt.

I'm not certain this is worth the extra complexity.

One reason I proposed "auth-1" as the extension name is so we could introduce an "auth-2" and make changes in the future if we need to.

But I think there's little value in this authentication hash being anything other than SHA-1. Remember that the data itself in the packfile following the authentication is only protected by SHA-1. If SHA-1 is considered too weak to protect the ref update commands then its likely also too weak to protect the file content following behind those same commands.

Getting stronger authentication here than SHA-1 would probably require changing the commit object name hash to something stronger than SHA-1, and the tree object name hash, etc. Remember that signed tags are only using the SHA-1 of the commit and that's only got the SHA-1 of the tree... ;-)

-- 
Shawn.