3 ms·
How does SSH authentication provide the same guarantees as signing commits?
by rmwaite 3y ago
How does SSH authentication provide the same guarantees as signing commits?
- dheera 3y agossh itself is cryptographically secure. the ciphertext of the commit being pushed is as good as a signature
- defanor 3y agoI guess you are considering the case where a single signer transfers commits over SSH to a single verifier, with both putting the same meaning into the act of transfer as people normally would into a signature. But git is a distributed VCS, with signatures handling many more scenarios: consider multiple committers and multiple signatures, transfer over multiple, different, untrusted channels, multiple verifiers.
- deleted 3y ago[deleted]