Usability issues with GCC release signatures
GCC release signatures are not PGP-standard, and use outdated crypto, impacting automated use and trust.
John Scott reports two usability and security issues with GCC release signatures. The .sig files are binary PGP, not ASCII-armored as per RFC 3156, preventing their direct inclusion in formats like Metalink via XInclude. Additionally, the primary key used for signing is a 1024-bit DSA key from 2001, and signatures use SHA-1, both considered insecure and distrusted by modern software.
- proposer
Reports that GCC release signatures are binary PGP, not ASCII-armored as required by RFC 3156, hindering integration with formats like Metalink. Also notes the use of a 1024-bit DSA key and SHA-1 for signatures, which are insecure and distrusted.
“The signature has file extension .sig and is served over HTTP with Content-Type: application/pgp-signature, but this doesn't conform to the accepted convention for a detached OpenPGP signature. In RFC 3156 [1], which is still the authoritative specification for this media type [2], it states the detached signature must always be in US-ASCII "armored" text format, but this detached signature is ac…”
In Details
The GCC release signing process uses OpenPGP signatures. This discussion highlights issues with the format of the signature files and the cryptographic strength of the keys and algorithms used. The binary format prevents direct inclusion in XML-based metadata formats like Metalink, and the outdated cryptography (1024-bit DSA, SHA-1) undermines trust in the signatures.
- Metalink
- An XML-based file format for distributing files, specifying checksums, origins, and PGP signatures to improve download reliability and security.
- RFC 3156
- Defines the 'application/pgp-signature' media type for detached PGP signatures, requiring them to be in ASCII-armored format.
- ASCII-armored
- A text-based encoding format for binary data, typically used for PGP signatures, making them easily transportable via email and text files.
- 1024-bit DSA key
- A deprecated type of digital signature algorithm key, considered too small and insecure by modern standards.
- SHA-1
- A cryptographic hash function that has known collision vulnerabilities, making it unsuitable for security-critical applications like digital signatures.
- OpenPGP
- A standard for encrypting and signing data, commonly used for email and file security.