undefined | Better HN

0 pointsdredmorbius1y ago0 comments

Signed checksums are generally sufficient to validate integrity. You could GPG encrypt / sign the entire payload as well if desired, though that requires recipients to have their own keys. Some 33 years after the introduction of PGP, this remains a significant stumbling block.

0 comments

3 comments · 1 top-level

Jerrrrrrry1y ago· 2 in thread

  signed

  keys

You just described using Out-of-Band communication, without using the words

  Some 33 years after the introduction of PGP, this remains a significant stumbling block.

'This problem was given the name the Two Generals Paradox by Jim Gray[8] in 1978 in "Notes on Data Base Operating Systems" starting on page 465.'

https://en.wikipedia.org/wiki/Two_Generals%27_Problem

dredmorbiusOP1y ago

Payload sizes of an OS distribution and a GPG signature / checksum differ by six or more orders of magnitude.

The validation checks themselves can be readily publicly distributed. Though of course if desired, they can also be distributed with media, or in a separate postal mailing.

PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages.

Jerrrrrrry1y ago

  Payload sizes

irrelevant

  validation checks themselves can be readily publicly distributed

how do you know which one? with the a priori key exchange / Out-of-Band communication?

  distributed with media

backdoor/spoofable/resignable

  >separate postal mailing

finally, full circle.

  PKI leverages OOB comms such that a single OOB exchange can validate an entire further chain of messages.

yes, hashing hashes and bloom filters arent novel.

ultimately, the only solution we have so far is:

https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...

j / k navigate · click thread line to collapse