Re: APT public key updates?
Steve Langasek <vorlon@debian.org> writes:
> AIUI, Ubuntu isn't rotating their archive keys -- something else that their
> centralized model more readily affords them.
I'm a little confused about why we do rotate the keys. I'm not
experienced in thinking through the subtle issues concerned, so I'm
trying to learn, because I know that Debian has plenty of people who
*do* have this experience, and I want to learn/understand.
With a non-expiring key, there is the risk that the key will be
compromised.
However, with the expiring key, there is the risk that a fake key will
be generated at the expected roll-over time.
In other words, I needed to fetch the new key this week, from the web
site, and tell my system "yeah, that's the right key." Of course, the
new key is signed with the old key. It's also signed with some sigs
that I haven't checked, which I assume are the Debian ftpmasters.
However, nothing about the apt-key procedure actually seems to have
*checked* any of these signatures.
Perhaps then we need to improve apt-key to implement a more careful
model?
If the key is compromised, which is the only way the non-expiring key
method can be broken, then the expiring key doesn't seem to be
offering all that much additional security.
Am I understanding rightly? missing something?
Thomas
Reply to: