Hacker News Reader

Comment by yourepowerless | Hacker News Reader

Huh, if only there were some way to digitally sign and secure communications, perhaps some sort of... Encryption scheme could be used to ensure accuracy of information...

View on HN

How do digital signatures solve the problem? The manipulator of the data just re-signs the new manipulated data. If you're suggesting that equipment (smartphones, DV cameras) sign their outputs, you still can't trust the signature-- How do you force the original signature to remain attached? How do you prevent anyone from faking some other device key and producing a new signature? This is effectively a problem related to the DRM realm, and DRM has failed to thwart pirates.

Leaps in logic to DRM and piracy aside, if you trust that you have the correct public key for a source, someone else's signature is not going to match the original key.

It's not much of a leap; both depend on trusting potentially attacker-controlled devices. If my sensor drone signs reports it sends back a remotely exploited drone could send back validly signed tampered data.

Exactly.

It's not a sheep vs. goats problem, where you just have to ID those bad machines and block them.

It's a defector problem. Any 'legitimate' machine can join a botnet at any moment, along with all the permissions and trust you vested it with back when you approved of whatever it was doing.

There was this interesting book by Mark Russinovich called Trojan Horse that dealt with the exact scenario. There was malware that got around the digital signature by altering the file in memory before signing and uploading to the email client.

I've gotten the impression that the NSA has their thump on the standard web of trust surrounding certificates.

Now if we combined IP addresses and public keys so they were one and the same we might be onto something.

That's essentially how Tor Hidden Services work. The private key is used to generate the public key (and the hash of that key). The hash is the onion address used to access the hidden service. Quite a clever combination.

Tor Hidden Services, I2P eepsites, CJDNS addresses, etc...

Reply on news.ycombinator.com