Hi,
Werner Koch:
> There are some minor problems because we don't just sign a hash but
> need to add some more data. Creating an incomplete hash on the remote
> machine is not the cleanest solution, so I have to come up with a
> better way.
>
You're the GPG expert...
I'm also a bit concerned about MitM attacks; the hash-or-whatever which
the local side is supposed to sign should probably be encrypted with the
signer's public key, otherwise I can just replace the data packet with
something that ends up signing a totally different file. :-/
In other words, doing this isn't trivial.
--
Matthias Urlichs | {M:U} IT Design @ m-u-it.de | [EMAIL PROTECTED]
Disclaimer: The quote was selected randomly. Really. | http://smurf.noris.de
- -
Show respect for age. Drink good Scotch for a change.
