0

So I'm making a distributed recovery system which consists of a bunch of hidden usb sticks. I plan to have the file be an executable, probably in the form of a appimage, which will contain my encryption software and encrypted volume.

The only hole in this plan is if someone modified the file or swapped it out with malware, which would send the attacker any password I entered.

I'm basically wondering if there is a way to make the file self verify, so instead of using a checksum the executable has to prove some way that it wasn't modified.

1 Answer 1

1

make the file self verify

This would be similar to asking a random person on the street about their identity - the person can simply lie. Instead one need to rely on something which the person has no control over and which is already trusted. This might be some government issued IDs (providing one trusts the government), it might be asking a trusted friend who also knows the other person or similar.

For validating software this might to use a tool on your disk outside of the control of the software. This tool might rely on a checksum stored on your disk, on trusted certificate authorities to check the signature on a software etc. But solely relying on something which might already be compromised is not secure.

2
  • Interesting, how about placing double layered encryption, without putting the encrypted volume in an exe? That way I can verify the file with the first password, and then if for example the title of the second volume is correct I know it wasn't modified. Also, how hard would it be for an attacker ti reverse engineer my executable binary and extract the encrypted volume? Feb 15 at 17:01
  • @Procapagana: Your proposal in the comment is no longer about self-validation of integrity. It is about validation with known information of what to expect. Insofar it is not much different from validating a checksum or similar. And, it is also beyond your original question, so please ask a new one for this. Feb 15 at 17:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.