3 ms·
If your public key on your website is hacked and your hash is on the website, well, your hash will be hacked too. If you're going to transmit the hash via a se
by demondemidi 3y ago
If your public key on your website is hacked and your hash is on the website, well, your hash will be hacked too.
If you're going to transmit the hash via a secure side channel, just transmit the public key.
I think the author is confusing secrecy with authenticity. The only way to prove the public key you received is really the intended public key is with a third party certificate authority that authenticates it. Which is what TLS does.
But I will assume the author is smarter than me.
Am I missing something or is this article useless? Just use the same secure channel for the hash but for the public key.
- Snawoot 3y agoSure you can. Fingerprint of key is just a shorter and more convenient option to reference key everywhere, including manual verification. Article tells just that and it's commonly used in the industry. And, by the way, signature in X.509 certificates ("TLS certificates") also hashes data to be signed - signed data input has to be smaller than sig size. Hence it also verifies pubkey indirectly.