Skip to content

Commit

Permalink
Merge remote-tracking branch 'origin/master'
Browse files Browse the repository at this point in the history 
Conflicts:
	public/blog/atom.xml
	public/blog/gems-signed-with-rubygems-openpgp.html
  • Loading branch information
@grant-olson
grant-olson committed Mar 21, 2013
2 parents 7c950fe + 35f07a6 commit e59342d
Show file tree
Hide file tree
Showing 3 changed files with 179 additions and 1 deletion.
58 changes: 58 additions & 0 deletions config/jekyll/_posts/2013-03-14-ca-exploited-by-uber-hacker-havenwood.markdown
View file
Expand Up @@ -73,6 +73,64 @@ against Havenwood's key. Any attempt to install software signed by
this key with the `--trust` option would now fail as the key will no
longer be trusted.

Example
-------

(This example assumes you've already trusted our keys as described in
[The Complete Guide to Signing the Certificate Authority Keys](/blog/the-complete-guide-to-signing-the-certificate-authority-keys.html).)

Get Havenwood's key and examine the signatures:

gpg --keyserver pool.sks-keyservers.net --recv-key 0x50DBC4B4
gpg --list-sigs 0x50DBC4B4

You'll see that you have both our original signature and the
revocation.

Here's a message Havenwood signed. Save this to a file somewhere:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is our world now... the world of the electron and the switch, the beauty of the baud.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBAgAGBQJRR1NRAAoJEM9hVGdQ28S00hcQALyHa/3ZpmWY7jwWLoXXZbpc
Pd+MXuH2cmkUBx/Xaeu8FzcNL05svBoZrQn8eJNTRgYN/zD5b8G6eD3a5w4PVO3I
7hP0zN+WRqUBvwuJdq7Ek0cdGNOMU+jGonSCfRhTwTNDBeDWkoIxkiIl+04BmSAD
7kBaHZu0vWbHjWEJkAM26KaE3r/bVYTojVO0D8RKdJ8d6H5nyRW8F3S+b4sHmwXY
hEb9zz1/QkUbU9L4I3I+ag43HAw9ywsTDcWfGk5G3V7aUCWYTMfoIjuEEhQYQAHJ
UcJy0cuJxQtOG6gP3N/x9WSeLmVOleTrJSVuV0CsDw9lR3ALHVZJ5A8HpevKe795
HokoVpwjN4580qKIeRZM2eB+P6sK8CJKXxh8rAqAsgv9TrsfXD8ESKy4iqF0ZS96
wSj5btHLU7Jk511w8wKWLr66fPTLd6wLP/+2Iw5BWntERMPMjICP8erDzw7Lah05
ghiSyj2lifMqwoXe4nznAVmihEjv7tOXE45IlSBc6nBUQxtMMgTzUTuqRbumMLXf
W2TYVYI01Dv/KWjo+XvmLNte8irhIoePRekj/Do0BD9hzYiN6ZrxZw7sgOswo+uV
g+NYUof3jVa2pd7RQo1ihbp0eqrtjQbOf6ZhvbUxu3DDoNkIS8j9DK3kXecoQW1W
A5sPId7OoYQUlId/RprT
=12Qp
-----END PGP SIGNATURE-----

Check the signature:

johnmudhead:~ grant$ gpg foo.txt.asc
gpg: Signature made Mon Mar 18 13:43:33 2013 EDT using RSA key ID 50DBC4B4
gpg: Good signature from "Shannon Skipper (havenwood) <blah@example.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 06CB 6789 306C 1DC4 BEAE ABF1 CF61 5467 50DB C4B4

Note the **WARNING** lines of text. This is because we our signature
is no longer included in the calculations.

If you ran `gem install foo --trust` against a gem signed by this key
the operation would now because the key is once again untrusted.

On the other hand, if you trusted the key by other means, for example
because you knew Havenwood personally, the install would succeed. Our
revocation doesn't state anything good or bad about Havenwood other
than the fact that you should ignore our previous certification.

And that's how our revocation system works
------------------------------------------

Expand Down
60 changes: 60 additions & 0 deletions public/blog/atom.xml
View file
Expand Up @@ -417,6 +417,66 @@ against Havenwood's key. Any attempt to install software signed by
this key with the &lt;code&gt;--trust&lt;/code&gt; option would now fail as the key will no
longer be trusted.&lt;/p&gt;

&lt;h2&gt;Example&lt;/h2&gt;

&lt;p&gt;(This example assumes you've already trusted our keys as described in
&lt;a href=&quot;/blog/the-complete-guide-to-signing-the-certificate-authority-keys.html&quot;&gt;The Complete Guide to Signing the Certificate Authority Keys&lt;/a&gt;.)&lt;/p&gt;

&lt;p&gt;Get Havenwood's key and examine the signatures:&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;gpg --keyserver pool.sks-keyservers.net --recv-key 0x50DBC4B4
gpg --list-sigs 0x50DBC4B4
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;You'll see that you have both our original signature and the
revocation.&lt;/p&gt;

&lt;p&gt;Here's a message Havenwood signed. Save this to a file somewhere:&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is our world now... the world of the electron and the switch, the beauty of the baud.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBAgAGBQJRR1NRAAoJEM9hVGdQ28S00hcQALyHa/3ZpmWY7jwWLoXXZbpc
Pd+MXuH2cmkUBx/Xaeu8FzcNL05svBoZrQn8eJNTRgYN/zD5b8G6eD3a5w4PVO3I
7hP0zN+WRqUBvwuJdq7Ek0cdGNOMU+jGonSCfRhTwTNDBeDWkoIxkiIl+04BmSAD
7kBaHZu0vWbHjWEJkAM26KaE3r/bVYTojVO0D8RKdJ8d6H5nyRW8F3S+b4sHmwXY
hEb9zz1/QkUbU9L4I3I+ag43HAw9ywsTDcWfGk5G3V7aUCWYTMfoIjuEEhQYQAHJ
UcJy0cuJxQtOG6gP3N/x9WSeLmVOleTrJSVuV0CsDw9lR3ALHVZJ5A8HpevKe795
HokoVpwjN4580qKIeRZM2eB+P6sK8CJKXxh8rAqAsgv9TrsfXD8ESKy4iqF0ZS96
wSj5btHLU7Jk511w8wKWLr66fPTLd6wLP/+2Iw5BWntERMPMjICP8erDzw7Lah05
ghiSyj2lifMqwoXe4nznAVmihEjv7tOXE45IlSBc6nBUQxtMMgTzUTuqRbumMLXf
W2TYVYI01Dv/KWjo+XvmLNte8irhIoePRekj/Do0BD9hzYiN6ZrxZw7sgOswo+uV
g+NYUof3jVa2pd7RQo1ihbp0eqrtjQbOf6ZhvbUxu3DDoNkIS8j9DK3kXecoQW1W
A5sPId7OoYQUlId/RprT
=12Qp
-----END PGP SIGNATURE-----
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;Check the signature:&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;johnmudhead:~ grant$ gpg foo.txt.asc
gpg: Signature made Mon Mar 18 13:43:33 2013 EDT using RSA key ID 50DBC4B4
gpg: Good signature from &quot;Shannon Skipper (havenwood) &amp;lt;blah@example.com&amp;gt;&quot;
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 06CB 6789 306C 1DC4 BEAE ABF1 CF61 5467 50DB C4B4
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;Note the &lt;strong&gt;WARNING&lt;/strong&gt; lines of text. This is because we our signature
is no longer included in the calculations.&lt;/p&gt;

&lt;p&gt;If you ran &lt;code&gt;gem install foo --trust&lt;/code&gt; against a gem signed by this key
the operation would now because the key is once again untrusted.&lt;/p&gt;

&lt;p&gt;On the other hand, if you trusted the key by other means, for example
because you knew Havenwood personally, the install would succeed. Our
revocation doesn't state anything good or bad about Havenwood other
than the fact that you should ignore our previous certification.&lt;/p&gt;

&lt;h2&gt;And that's how our revocation system works&lt;/h2&gt;

&lt;p&gt;Thanks for being a good sport Havenwood.&lt;/p&gt;
Expand Down
62 changes: 61 additions & 1 deletion public/blog/ca-exploited-by-uber-hacker-havenwood.html
View file
Expand Up @@ -177,6 +177,66 @@ <h2>How Do Users Get the Revocation Certificate?</h2>
this key with the <code>--trust</code> option would now fail as the key will no
longer be trusted.</p>

<h2>Example</h2>

<p>(This example assumes you've already trusted our keys as described in
<a href="/blog/the-complete-guide-to-signing-the-certificate-authority-keys.html">The Complete Guide to Signing the Certificate Authority Keys</a>.)</p>

<p>Get Havenwood's key and examine the signatures:</p>

<pre><code>gpg --keyserver pool.sks-keyservers.net --recv-key 0x50DBC4B4
gpg --list-sigs 0x50DBC4B4
</code></pre>

<p>You'll see that you have both our original signature and the
revocation.</p>

<p>Here's a message Havenwood signed. Save this to a file somewhere:</p>

<pre><code>-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is our world now... the world of the electron and the switch, the beauty of the baud.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (Darwin)

iQIcBAEBAgAGBQJRR1NRAAoJEM9hVGdQ28S00hcQALyHa/3ZpmWY7jwWLoXXZbpc
Pd+MXuH2cmkUBx/Xaeu8FzcNL05svBoZrQn8eJNTRgYN/zD5b8G6eD3a5w4PVO3I
7hP0zN+WRqUBvwuJdq7Ek0cdGNOMU+jGonSCfRhTwTNDBeDWkoIxkiIl+04BmSAD
7kBaHZu0vWbHjWEJkAM26KaE3r/bVYTojVO0D8RKdJ8d6H5nyRW8F3S+b4sHmwXY
hEb9zz1/QkUbU9L4I3I+ag43HAw9ywsTDcWfGk5G3V7aUCWYTMfoIjuEEhQYQAHJ
UcJy0cuJxQtOG6gP3N/x9WSeLmVOleTrJSVuV0CsDw9lR3ALHVZJ5A8HpevKe795
HokoVpwjN4580qKIeRZM2eB+P6sK8CJKXxh8rAqAsgv9TrsfXD8ESKy4iqF0ZS96
wSj5btHLU7Jk511w8wKWLr66fPTLd6wLP/+2Iw5BWntERMPMjICP8erDzw7Lah05
ghiSyj2lifMqwoXe4nznAVmihEjv7tOXE45IlSBc6nBUQxtMMgTzUTuqRbumMLXf
W2TYVYI01Dv/KWjo+XvmLNte8irhIoePRekj/Do0BD9hzYiN6ZrxZw7sgOswo+uV
g+NYUof3jVa2pd7RQo1ihbp0eqrtjQbOf6ZhvbUxu3DDoNkIS8j9DK3kXecoQW1W
A5sPId7OoYQUlId/RprT
=12Qp
-----END PGP SIGNATURE-----
</code></pre>

<p>Check the signature:</p>

<pre><code>johnmudhead:~ grant$ gpg foo.txt.asc
gpg: Signature made Mon Mar 18 13:43:33 2013 EDT using RSA key ID 50DBC4B4
gpg: Good signature from "Shannon Skipper (havenwood) &lt;blah@example.com&gt;"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 06CB 6789 306C 1DC4 BEAE ABF1 CF61 5467 50DB C4B4
</code></pre>

<p>Note the <strong>WARNING</strong> lines of text. This is because we our signature
is no longer included in the calculations.</p>

<p>If you ran <code>gem install foo --trust</code> against a gem signed by this key
the operation would now because the key is once again untrusted.</p>

<p>On the other hand, if you trusted the key by other means, for example
because you knew Havenwood personally, the install would succeed. Our
revocation doesn't state anything good or bad about Havenwood other
than the fact that you should ignore our previous certification.</p>

<h2>And that's how our revocation system works</h2>

<p>Thanks for being a good sport Havenwood.</p>
Expand All @@ -191,7 +251,7 @@ <h2>Related Posts</h2>

<li><span>24 Feb 2013</span> &raquo; <a href="/blog/the-complete-guide-to-signing-the-certificate-authority-keys.html">The Complete Guide to Signing the Certificate Authority Keys</a></li>

<li><span>04 Mar 2013</span> &raquo; <a href="/blog/key-revocation.html">Key Revocation</a></li>
<li><span>23 Feb 2013</span> &raquo; <a href="/blog/the-complete-guide-to-verifying-gems-with-rubygems-openpgp.html">The Complete Guide to Verifying Gems with rubygems-openpgp</a></li>

</ul>
</div>
Expand Down

0 comments on commit e59342d

Please sign in to comment.