3 ms·

The SKS keyserver thing was 5 years ago. It seems to be working. Was uploading a key somewhere a requirement for submitting to PyPi? Why were the keys not avail

The SKS keyserver thing was 5 years ago. It seems to be working. Was uploading a key somewhere a requirement for submitting to PyPi? Why were the keys not available from PyPi? It just seems to me that there wasn't anything here in the first place. Something something PGP keys. Perhaps they were hoping for someone to come along and make a working system and no one ever did.

woodruffw 2y ago
Could you clarify: which part seems to be working? The SKS servers certainly aren't, and the keyservers that are currently online don't appear to gossip or share keys with each other. That's why the post's dataset comes from querying the biggest/most popular ones manually. > Was uploading a key somewhere a requirement for submitting to PyPi? Where would "somewhere" be? If it was PyPI itself (or a server controlled by PyPI), replacing the key material would be trivial and would largely defeat the purpose of having signatures instead of just hashes. In the past, "somewhere" could have been a gossiping SKS server. But that would tie PyPI's reliability and availability to that of the SKS network, which was never great even at its prime. > Why were the keys not available from PyPi? For the reason mentioned above: if PyPI is trusted to distribute the key material, then an attacker can simply replace the keys used to sign for the package. This makes it no better than having PyPI distribute hashes (which it already does), but a lot more complicated. To my understanding, the reason PyPI originally accepted PGP keys is because someone asked for it and baseline expectations around security were more laissez-faire at the time: there was no baseline expectation that millions of people might be using `pip` (or `easy_install` at the time), and that all of them deserve the same integrity and authenticity properties as a small core of expert users. Those expectations have shifted over time towards the belief that ordinary users should also have signatures accessible to them, and I'm inclined to believe that's a good thing.
- upofadown 2y ago
  We have sorta drifted into pure speculation... Just to be clear, I reject your contention that there might be some sort of identity verification benefit associated with distributing the keys across the SKS network. Cryptographic identity is normally represented by a really long number of some sort (called a key fingerprint in the PGP case). a PGP identity contains an email address, but that is a completely unfounded assertion from the creator of the identity. That contention has to be supported in some way. Anyone can create as many PGP identities as they want with any email address in them. They can upload those identities anywhere they want and they might be replicated. An attacker can't "replace" a PGP identity because they can't create another identity that matches the key fingerprint.
  - woodruffw 2y ago
    > Just to be clear, I reject your contention that there might be some sort of identity verification benefit associated with distributing the keys across the SKS network. I don't understand why you think I'm contending this. The claim is not that SKS distributes meaningfully verifiable identities, it's that there is no longer a reliable, scalable way to discover public keys at all in PGP. Whether or not you trust those public keys or the claimant human identities in them is a separate subsequent step; the entire argument is that the failure mode happens before then, and that this makes PGP an unsuitable serious choice for scaling signatures on PyPI. (PGP fingerprints are a red herring -- it doesn't matter how forgeable or unforgeable a key's fingerprint is if I can't discover the key. No key, no verification, full stop.)

woodruffw 2y ago

Could you clarify: which part seems to be working? The SKS servers certainly aren't, and the keyservers that are currently online don't appear to gossip or share keys with each other. That's why the post's dataset comes from querying the biggest/most popular ones manually. > Was uploading a key somewhere a requirement for submitting to PyPi? Where would "somewhere" be? If it was PyPI itself (or a server controlled by PyPI), replacing the key material would be trivial and would largely defeat the purpose of having signatures instead of just hashes. In the past, "somewhere" could have been a gossiping SKS server. But that would tie PyPI's reliability and availability to that of the SKS network, which was never great even at its prime. > Why were the keys not available from PyPi? For the reason mentioned above: if PyPI is trusted to distribute the key material, then an attacker can simply replace the keys used to sign for the package. This makes it no better than having PyPI distribute hashes (which it already does), but a lot more complicated. To my understanding, the reason PyPI originally accepted PGP keys is because someone asked for it and baseline expectations around security were more laissez-faire at the time: there was no baseline expectation that millions of people might be using `pip` (or `easy_install` at the time), and that all of them deserve the same integrity and authenticity properties as a small core of expert users. Those expectations have shifted over time towards the belief that ordinary users should also have signatures accessible to them, and I'm inclined to believe that's a good thing.

upofadown 2y ago
We have sorta drifted into pure speculation... Just to be clear, I reject your contention that there might be some sort of identity verification benefit associated with distributing the keys across the SKS network. Cryptographic identity is normally represented by a really long number of some sort (called a key fingerprint in the PGP case). a PGP identity contains an email address, but that is a completely unfounded assertion from the creator of the identity. That contention has to be supported in some way. Anyone can create as many PGP identities as they want with any email address in them. They can upload those identities anywhere they want and they might be replicated. An attacker can't "replace" a PGP identity because they can't create another identity that matches the key fingerprint.
- woodruffw 2y ago
  > Just to be clear, I reject your contention that there might be some sort of identity verification benefit associated with distributing the keys across the SKS network. I don't understand why you think I'm contending this. The claim is not that SKS distributes meaningfully verifiable identities, it's that there is no longer a reliable, scalable way to discover public keys at all in PGP. Whether or not you trust those public keys or the claimant human identities in them is a separate subsequent step; the entire argument is that the failure mode happens before then, and that this makes PGP an unsuitable serious choice for scaling signatures on PyPI. (PGP fingerprints are a red herring -- it doesn't matter how forgeable or unforgeable a key's fingerprint is if I can't discover the key. No key, no verification, full stop.)