Re:Ditching OpenPGP, a new approach to signing APT repositories
by julian-klode on Tuesday June 22, 2021 @04:29AM
(#27589302)
> # The algorithm is stored with the signature. > This is slightly less bad than above, but still bad
So I just also realized that for the subkey scheme, it matters even less, because the algorithm is effectively part of the subkey packet.
It's not encoded in there, but how high is the chance that a different algorithm would produce the same signature for it?
We really just need the algorithm field to be able to determine how to parse that, but it reinforces itself by virtue of the subkey being signed by the primary key itself.
So I just also realized that for the subkey scheme, it matters even less, because the algorithm is effectively part of the subkey packet.
It's not encoded in there, but how high is the chance that a different algorithm would produce the same signature for it?
We really just need the algorithm field to be able to determine how to parse that, but it reinforces itself by virtue of the subkey being signed by the primary key itself.