3

When updating Ubuntu with the default setup, do updates need to be signed by multiple people, or is it a single person who controls what updates to sign?

The reason I'm asking is that if a single person or company is in control then it's not really safe. Take Apple as an example, even if I trust Apple (or Microsoft for that matter) the updates are not really secure as they might be forced to share their private keys.

By distributing the trusted people / companies around the world we would really decrease the chance of fake updates.

How is the signing done for the Ubuntu main repository?

|improve this question
  • It all boils down to the people holding the keys. Are two trusted people enough? Ten? Fifty? Or perhaps differently, is there a duress system that successfully signs the code, but flips a bit "I was forced to do this against my will"? – Piskvor Mar 16 '16 at 14:46
  • In general, the advantage of a single key-holder is that you can watch them very very closely to make sure they're doing everything by the book - which is impossible in a distributed model. – Mike Ounsworth Mar 16 '16 at 14:48
  • Even with distrbuted signing, unless you have parallel development/code review you risk malicious code being signed due to the author being "malicious" or compromised. – Rоry McCune Mar 16 '16 at 15:10
  • @MikeOunsworth There is no difference on how "closely" you can "watch" what they're doing. The only difference is that more people signs off on the changes. – Alex Mar 17 '16 at 5:34
5

Answering your direct question:

You should read the pages on Secure Apt Ubuntu, and a slightly more thorough page on Secure Apt Debian.

The summary is that packages are signed using gpg (aka "gnupg") which is a distributed web-of-trust style public key infrastructure - this should make you happy. In the PGP / GPG world, people sign each other's keys to form a "web of trust". By default on a new Debian system, there's one trusted key in your apt keyring belonging to 

Debian Archive Automatic Signing Key <ftpmaster@debian.org>

so anybody they trust, you automatically trust. If you add a 3rd party repository / PPA to apt, part of that process is adding their signing key to apt's list of trusted keys.

If you want to know more about how packages are vetted, and how signers are added to the trusted list, I'm sure you can find out more by digging into the Ubuntu and Debian communities.

Answering the broader question:

Is it really true that a central authority is less trustworthy than a distributed system? I don't think it is.

Whatever you may think about Apple or Microsoft's requirement to bend to law enforcement, one thing you can be sure of is that they hire good security teams, and that the server holding the signing key is very well secured against hackers - probably with hundreds of thousands of dollars of security equipment and firewalls. Can the same be said of every gpg user who has signing power on the ubuntu repositories? I don't even know how I would go about auditing that ... and that's the point because a web is only as strong is its weakest link.

So yes, Apple or Microsoft may be forced to sign something on behalf of the government (which Apple is spending a lot of money fighting in court, by the way), but distributed systems are WAAYY easier to hack into and steal a key simply because individuals can not spend as much money on security as large companies can. So what's the lesser of two evils: a large security-conscious company under American law, or a collection of individuals who are easily hacked?

|improve this answer
  • Just want to add that Apple likely can't fight FISA warrants. We don't know if they've acquiesced to them in the past or will in the future. – Neil Smithline Mar 16 '16 at 19:41
  • @NeilSmithline Could you elaborate on how FISA warrants are relevant to code-signing keys? Aren't warrants usually about database access and decryption keys? – Mike Ounsworth Mar 16 '16 at 19:58
  • I think we are unclear as to the scope of FISA court orders (perhaps "warrants" was the wrong word). I've assumed, tho am far from certain, that the FISA court could require a company to sign a binary written by the NSA or similar and that the company would be forced to comply with the order as well as keeping the order secret. – Neil Smithline Mar 16 '16 at 22:39
  • But isn't that exactly what the current court case is about? FBI wants Apple to sign an Over-The-Air iOS update that bypasses the lock screen so that the FBI can apply it to the one phone they have? – Mike Ounsworth Mar 16 '16 at 22:45
  • No. The current case is from a regular court, the FISA court is only for foreign intelligence. You cannot discuss FISA court business. Their cases happen secretly without our knowledge. We are uncertain if they could, for example, order that Apple signs the code for a snooping app. See cnn.com/2014/01/17/politics/surveillance-court – Neil Smithline Mar 16 '16 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.