Skip to content

signify - allow single-round signing (without trusted comment) #502

@monoidk

Description

@monoidk

AFAICT ever since #412 landed, trezor-signify unconditionally creates a trusted comment section in minisign format, which requires two rounds of signing (one for file, one for comment).
From my testing and first relevant page I found (https://hlischt.com/signify-minisign), signify and minisign are not the same i.e. the overall structure besides the signature itself differs. AFAICT signify does not support the trusted comment section.

It would be nice for trezor-signify to support creating single-round signatures (at least for pure signify, not sure about compatibility with minisign). Main reasons would be:

  • it seems iffy security wise to always press sign two times
  • it is a bother to press sign two times
  • the comment is not verified anyway, if using signify or signify-openbsd (as available on debian, even older version)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions