← @ChristopherA Twitter archive
Christopher Allen
@ChristopherA
Interesting! It looks like you can soon sign git commits with ssh too. Also pleased they have signature name spaces (similar to proof purpose in DIDs) – lack of this is a common flaw in a number other signature schemes. 🕵🏻♂️ https://twitter.com/__agwa/status/1459194182459961346
11/13/2021, 9:48:03 AM
Favs: 24
Retweets: 4
linkChristopher Allen
@ChristopherA
Also important to me is ssh is pre-installed in most systems today, so you don’t have to install anything to bootstrap file signing. This has always been a catch-22 when I’ve looked into securing a new system against install hijacking (e.g. curl | bash) & supply-chain attacks.
11/13/2021, 10:10:28 AM
Favs: 2
Retweets: 0
linkChristopher Allen
@ChristopherA
One of the concerns might be that GitHub is suggested for key distribution, but you instead use did:onion method (https://blockchaincommons.github.io/did-method-onion/ & implemented at
https://github.com/BlockchainCommons/torgap-demo). /cc @__agwa
11/13/2021, 10:14:24 AM
Favs: 0
Retweets: 0
linkChristopher Allen
@ChristopherA
We have a solution for a “universal donor” 25519 key that can be transformed into both minisign & tor keys (https://github.com/BlockchainCommons/torgap-sig & https://github.com/BlockchainCommons/torgap-sig-cli-rust). I’ll have to see if there are any issues with leveraging ssh keys as well.
11/13/2021, 10:15:06 AM
Favs: 0
Retweets: 0
link