1
$\begingroup$

I’m interested in the tradeoffs of signing individual files vs. signing a manifest of cryptographic hashes and file names.

Let’s say I do some work that results in a handful of files (10s to hundreds), and then I send all that work out for someone else to look at and maybe pass on to others. Later, I may wish to verify that certain of these files have both authenticity (came from me) and integrity (have not been modified). Others with my public key may wish to do the same.

Digital signatures are the obvious solution. A separate signature for each file is a hassle for a number of reasons (verification is tedious, lots of clutter, etc.). This seems to be the reason that some websites provide a signed manifest of hashes rather than separate signatures for each file on multi-file downloads.

My question is, do I achieve similar guarantees as a per-file signature by first creating a text file of cryptographic hashes of all the original files, and then signing that text file with something like Minisign or GPG? I believe signing algorithms already hash the original file and then sign the hash, so this seems like just adding one more hashing step in front. However, I know cryptography is full of subtle ways to mess everything up, so I am curious about the pitfalls of this approach. This scheme seems to provide the added benefit of signing the file names as well as their hashes, so it’s resistant to file renaming like changing block_list.txt to allow_list.txt. It also offers a list of hashes for people to verify only integrity if they receive the files over an existing trusted channel.

$\endgroup$

1 Answer 1

1
$\begingroup$

Yes, chaining two secure mechanisms like this works, and is considered secure.

If you use a secure hash function, an attacker would not be able to provide a different file and keep the manifest as is.

If the signature scheme is secure an attacker would not be able to change the manifest and still have the signature pass validation.

Note with a manifest you get extra protection of an attacker not being able to omit files without detection. Individual signing allows this. For better or worse. You will not be able to validate a single file without the manifest which means you will at least know of the existence of other files.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.