4 ms·
> When you send messages, they're signed with your SSH key It seems to me that they're encrypted with your private key and paired with "username". The client t
by grrowl 11y ago
> When you send messages, they're signed with your SSH key
It seems to me that they're encrypted with your private key and paired with "username". The client then attempts to decrypt using the public key associated with that username on github.
In this system, the receiver and any MITMs (okay, so everyone) know it came from "the real grrowl according to github" — authenticated but not confidential at all.
- codahale 11y agoTwo things: First, you're describing RSA signatures. "Encrypt X with your private key" means "X^D mod N" which is how RSA signatures work. In the context of RSA-based cryptosystems, it's clearer to just say "signed". Second, the ghsign library uses the `RSA-SHA1` signer, which runs the message through SHA1 before signing it. The reason it does this is because "textbook" RSA (i.e. RSA on arbitrary messages) is vulnerable to chosen-plaintext attacks.
- grrowl 11y agoThis is an invaluable comment — thank you.