Websites that host downloadable executables often provide measures to confirm the integrity of the data that is available to download. Such measures include:
- Hosting the website under HTTPS;
- Providing the SHA-256 sum of the downloaded binary (the end user is advised to compute the checksum on their own and see if both sums match);
- Providing the publisher's PGP public key and the PGP signature of the binary (the end user is advised to check the signature against the provided public key).
To my understanding these are the three major threats that may compromise the integrity of downloaded data:
- Due to a MitM attack the binary is downloaded from a different source than intended - hosting the website under HTTPS is supposed to prevent this;
- Due to network errors the downloaded data is accidentally modified (SHA or even MD5 sums are supposed to not match if this occurs);
- The website hosting the downloads is compromised and a third party has injected their own malicious binaries to the website: PGP signatures are supposed to fail to verify if this is the case.
This is the part I fail to understand. Let me provide an example.
Example: VeraCrypt
VeraCrypt installers & binaries, as well as their respective PGP signatures are available to be downloaded from https://www.veracrypt.fr/en/Downloads.html . This same webpage provides the PGP public key:
PGP Public Key: https://www.idrix.fr/VeraCrypt/VeraCrypt_PGP_public_key.asc (ID=0x680D16DE, Fingerprint=5069A233D55A0EEB174A5FC3821ACD02680D16DE)
Now assume that the idrix.fr website is compromised and serving malicious binaries. In that case what prevents the malicious 3rd party from computing their own public/private key pair, replace the public key provided by the website with their own (they own the website now) and replace the signatures of the binaries with ones signed by their own key?
Since the same website serves the public key, signatures and actual downloads I cannot see how is this supposed to increase security? If the website is not compromised then the measure is unnecessary; if it is compromised then the attacker can modify all three and the measure fails to provide security.
If the public key was hosted somewhere else (like Ubuntu keyserver) then it would make more sense to me: the Ubuntu keyserver would now verify the legitimacy of the public key (with the assumption that it is unlikely that both idrix.fr and keyserver.ubuntu.com domains are compromised simultaneously). However, it doesn't seem to me to be the case.
What am I missing here? What am I failing to understand?