PGP needs to be retired in honor

Re:PGP needs to be retired in honor by falcolas on Thursday February 23, 2017 @04:26PM (#13717946)

> Is the sort of signing you want to do for code signing related to the sort of signing you want to do as part of an encryption scheme?

Same basic concept. Take a blob (compiled code or cyphertext) and a private key and sign it, so can be verified with the public key later.

https://en.wikipedia.org/wiki/Authenticated_encryption

This kind of PGP signing is also critical to the security of Linux software repos. Debian repos sign the contents of the manifest (which includes hashes of packages), and Apt repos sign individual files.

[ Parent | on HN ]

Re:PGP needs to be retired in honor by geofft on Thursday February 23, 2017 @05:27PM (#13718438)

These aren't related at all! Authenticated encryption uses a symmetric MAC. Code signing is asymmetric.

[ Parent | on HN ]