-
Notifications
You must be signed in to change notification settings - Fork 151
Open
Description
AFAICT ever since #412 landed, trezor-signify
unconditionally creates a trusted comment section in minisign
format, which requires two rounds of signing (one for file, one for comment).
From my testing and first relevant page I found (https://hlischt.com/signify-minisign), signify
and minisign
are not the same i.e. the overall structure besides the signature itself differs. AFAICT signify
does not support the trusted comment
section.
It would be nice for trezor-signify
to support creating single-round signatures (at least for pure signify
, not sure about compatibility with minisign
). Main reasons would be:
- it seems iffy security wise to always press sign two times
- it is a bother to press sign two times
- the comment is not verified anyway, if using
signify
orsignify-openbsd
(as available on debian, even older version)
Metadata
Metadata
Assignees
Labels
No labels