3 ms·
https also provides secure authentication, not merely encryption. The encryption part also guarantees the authentication part by proving that the stream can not
by isityouyesitsme 3y ago
https also provides secure authentication, not merely encryption. The encryption part also guarantees the authentication part by proving that the stream can not have been modified.
In order to meet this guarantee for the scheme you're discussing, the hashes themselves need to have a tamper evident. What is this tamper evident?
- akho 3y agoYes, that's clear. I'm not very familiar with how quicklisp works. I thought that “updates once a month” implies a separate update channel (distribution, ...). Looking at the relevant issue, https://github.com/quicklisp/quicklisp-client/issues/167 https://github.com/quicklisp/quicklisp-client/issues/167 , it's not clear that even hashes are in place. I recently found out that most Nix fetchers use https, but do not actually do verification (`curl --insecure` or equivalent libcurl settings). Channel updates do verify and include hashes, so the overall chain is authenticated.