oss-sec mailing list archives
OpenBSD signify and "fingerprint"
From: Florian Weimer <fw () deneb enyo de>
Date: Mon, 29 Dec 2014 14:09:20 +0100
This is just a warning that what OpenBSD's signify tool calls a “fingerprint” is very different from the concept of a fingerprint in OpenPGP. It is just a random 64-bit blob with no relationship to the raw public key used for signing. Conceptually, it is similar to the OpenPGP key ID (it is used as a quick check that public key and signature match), except that it is even more trivial to forge. Fortunately, typical usage patterns of the signify tool do not expose the fingerprint to the user, so there is no immediate temptation to use it for validating a key (which is the primary use case for fingerprints in OpenPGP). It is also short (64 bits) and thus not very secure to the initiated, no matter how it is computed, but I'm not fully convinced that this is a sufficient deterrent. Maybe a different term instead of “fingerprint” could be used to reduce the potential for confusion. Something like “key number” or “key slot” might be appropriate (because these terms do not confer any identifying property).
Current thread:
- OpenBSD signify and "fingerprint" Florian Weimer (Dec 29)
- Re: OpenBSD signify and "fingerprint" Ted Unangst (Dec 29)
- Re: OpenBSD signify and "fingerprint" mancha (Dec 30)