On 12/18/2008 05:15 PM, David E. Ross:
Actually, a digital signature DOES NOT necessarily guard a document from attack. An attacker might still be able to delete a signed document.
I'm not aware of any PKI solution that protects from deletion. That would have to be handled properly on the file system (and access thereof). However file systems can be encrypted these days easily, and the protection happens elsewhere.
A digital signature assures integrity, allowing the reader to determine if the document has been altered. An alteration might NOT be an attack; it could instead be merely a dropped bit during transmission.
Oh yes, you'd certainly like to know about it (and why that d*** file doesn't open) :-)
I don't think either integrity or authenticity are an issue with attachments to Bugzilla reports. Those two issues are well handled by the fact that Bugzilla operates under SSL. Thus, signatures should not be required for PDF documents.
Kyle's use case would be rather of saving the files on the local computer. Even though I also believe that the reports are as save as Bugzilla can be, it might present a certain stance (for our group), but also prevent from modification obviously. Not the highest priority, still interesting to play with it...
-- Regards Signer: Eddy Nigg, StartCom Ltd. Jabber: start...@startcom.org Blog: https://blog.startcom.org _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
