News for hackers. Stuff that matters.

A comment on Keybase launches encrypted Git. Parent comment

Re:Keybase launches encrypted Git by Foxboron on Wednesday October 04, 2017 @12:49PM (#15401827)
While talking about git and security:

Signing tags are not as affective as you'd think. refs are never actually signed, it's the objects they are pointing at that are signed. This opens up to interesting attacks where you can move refs around to previous vulnerable versions.

Git also never checks if the metadata the tag points at is correct!

Interesting paper: https://www.usenix.org/system/files/conference/usenixsecurit...

[ Parent | on HN ]
Re:Keybase launches encrypted Git by im_down_w_otp on Wednesday October 04, 2017 @10:45PM (#15406403)
Yeah, we implemented this paper's proposal (their version has some bugs, gaps, and infinite loop issues) where I work to be able to have higher assurance on the validity of our source repositories.

First version in shell with a fairly robust test suite, and the next version in Rust. Originally started to do it in Rust, but libgit2 was sufficiently obtuse that we opted for getting to a complete, working thing first.

[ Parent | on HN ]