> IBM sign the hash (in fact they sign whole serverpac) I think the "whole serverpac" is effectively signed -- but the way that is done is to sign the hash. There are security advantages too long a digression for this reply.
> If you really want to encrypt the content (ie. DVD files) then you have to > make your pair of PRIVATE/PUBLIC keys. Yes, the customer has to do it and ask > IBM to use his public key Yep, that is the process that certificates and the TLS protocol automate. TLS does not do anything for you in terms of encryption that you could not do on your own -- but worst case doing it without TLS would require your sending a courier with a briefcase containing a secret key locked to his wrist to IBM, and IBM maintaining a secret key for each customer. TLS automates that process, securely. Charles -----Original Message----- From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On Behalf Of R.S. Sent: Wednesday, April 4, 2018 7:52 AM To: IBM-MAIN@LISTSERV.UA.EDU Subject: Re: Software Delivery on Tape to be Discontinued W dniu 2018-04-04 o 02:58, Andrew Rowley pisze: > On 4/04/2018 10:53 AM, Charles Mills wrote: >> No, a digital signature does not require an authority. >> >> I publish my public key on my Web site. >> > How do I verify that the key that I see browsing your website is > really yours and hasn't been e.g. substituted in transit? Key exchange > is the hardest bit of cryptography. > It is simple. ServerPac content is something non-secret - we don't want to encrypt it, we only want to be sure it is not altered by bad guys. (Let's assume it for a while) So, we checksum he content using SHA. Everybody can check it is not tampered by repeating cheksum and comparing hash values with ...with WHAT? Hash values can also be modified! Of course IBM could pay for TV and newspaper commercial advertisement containing those values, but it is not practical way. ;-) However such way shows one of possible solutions: to deliver checksums using alternate way. The other method could be to SIGN the hash value. Sign is a method from assymetric cryptography family. IBM sign the hash (in fact they sign whole serverpac) using it's PRIVATE key, which is the deepest secret of IBM, however *everybody* (including bad guys) can obtain PUBLIC key from IBM and the public key plus method allows everybody to confirm (or deny) this information was signed by IBM. Note, the content is still not encrypted. Is it possible to encypt it? For SSL/TLS download , it is unnecessary, because whole transmission is encrypted (and hard to break despite gossips). If you really want to encrypt the content (ie. DVD files) then you have to make your pair of PRIVATE/PUBLIC keys. Yes, the customer has to do it and ask IBM to use his public key. A little bit complex - IBM would have to collect and maintain keys from every customer. Each customer should take care about the keys again disclosure and ...lost. Keys should be replaced periodically, etc. IMHO much to much trouble for such content. ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
