If you downloaded a version of a signature verification program that might have been modified, you naturally check its signature. But what if you have none such program to check it (whose signature has been checked)? It appears to be a Catch-22.

GnuPG download instructions:

Note: you should never use a GnuPG version you just downloaded to check the integrity of the source — use an existing, trusted GnuPG installation, e.g., the one provided by your distribution.

(emphasis theirs)

But what if you have none such installation provided by your own distribution, or if your old, trusted distribution has an exploit, which would be fixed by the new version?

  • How paranoid do you want to be? Unless you're targeted by a state-sponsored attacker (and even then) I think it's safe to download GPG from a bunch of unrelated sites from different locations (all over HTTPS). If multiple sites share the same file (which can be compared using sha1sum/sha256sum) there's a good chance the GPG download is authentic. Jul 11, 2016 at 15:46
  • @AndréBorie theoretical question, for the whistleblowers out there Jul 11, 2016 at 15:50
  • What if your entire OS, and thus browser and network stack were already compromised? Signature checking won't help. At some point you have to trust someone. Related: Reflections on trusting trust Jul 11, 2016 at 15:54
  • @AndréBorie I can build my own computer from scratch and my own signature checking application from scratch. Jul 11, 2016 at 15:58
  • @JamesLu - if you are that paranoid then you may want to beware of compromised SoCs and compilers - unless you are building your computer from simple logic gates and writing an entire stack, starting with machine code - though any computer built in such a way wouldn't be very efficient or fast...
    – Stu W
    Jul 12, 2016 at 10:57

3 Answers 3


Your question boils down to "how can I initially construct a trust chain". No matter how you want to verify the download or individual steps (for example, X.509 certificates for HTTPs), you will have to start trusting somewhere.

The most paranoid method of verification would be meeting GnuPG's main author, Werner Koch (and/or others from the core team). But as you don't know him yet, consider how to verify his identity (for sure, a powerful governmental organization would be able to issue faked ID cards).

Otherwise, you could start with trusting your operating system distribution for downloading and verifying GnuPG. Maybe you're even running Linux for a long time, and fetched copies from lots of different locations. This is "trust on first use" in the broader sense: you expect that the first contact (older copies of Linux) have been fine before you even might be considered a target worth the vast effort of such manipulations.

If you don't trust a single copy (as it might be manipulated), go for multiple of them, repeating the step individually. You will find Linux distribution media "kind of everywhere": computer magazines in stores, as add-on to library books, by asking your friends. It is very unlikely that an attacker was able to fiddle with all of them. Whenever somebody enlarges the scope of manipulations, chances of getting caught increase.


It's a good practice to rely on your distro for this, but I don't view it as a requirement. You can still download GNUPG from their site and follow their process for validating the files:


  • how could you check for the signature of the distro? This is an NSA-paranoid level question. Jul 11, 2016 at 15:46
  • sha1 can be easily spoofed - some researchers were able to create a program that replicated a sha1 hash for any input by appending characters. it ran quickly too. - and what if sha1sum is susceptible to MITM? how do you verify it's signature? Jul 11, 2016 at 15:49
  • Unless you wrote the application yourself, you'll have to rely on some third party's verification (e.g., checksum) at some point in the process.
    – HashHazard
    Jul 11, 2016 at 16:07
  • @JamesLu "a program that replicated a sha1 hash for any input by appending characters. it ran quickly too.": Can you provide a source for this? I know such of program for MD5, but never encountered the equivalent for SHA1. Jul 13, 2016 at 8:08
  • @WhiteWinterWolf Here you go: sites.google.com/site/itstheshappening (75k-120k, but within the budget of criminal and government organizations) Jul 13, 2016 at 18:36

One way round this could be to download it and use another system to verify the hash. Or multiple other systems after putting it on to read only media.

If you lack spare systems yourself then you could enlist some friends or other third parties.

You could burn a CD-R (or other write once media), fill any free space with garbage, note any serial numbers, sign the back of it with a cd pen and then hand it to a trusted friend to verify in front of you if you were especially paranoid. You could repeat the process with several different third parties.

Edit: A drive with no writing electronics or hardware write blockers could also be used

Disclaimer: I have just written this while thinking about it. You may not want to do all of the above and there are probably some holes in this scheme - though please point them out in the comments / downvote as appropriate :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .