Re: PREVIEW: bsign embeds hash and/or digital signature in ELF files
On Mon, 14 Dec 1998, Buddha Buck wrote:
> If this isn't the case, then signed email is worthless, since many
> people can (and to a limited extent, do) write to and modify the
> message in transit.
Email you know who was supposed to sign it (the sender) and you trust the
content based on that tag in an intelligent way. So yes someone could
hijack your mail, remove the signature, resign it with another key and
change the from address but you would notice that! With an embedded
signature that can be one of many choices all the attacker has to do is
break one of the many keys and resign it that one, or insert his key into
the keyring and sign, etc. This is why digital signatures that we
distribute with packages have little worth.
Jason
Reply to: