7

Many downloads offer an OpenPGP signature, which can be used to verify the file, but if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?

0

4 Answers 4

12

The signature can be changed, yes, but it won't be valid unless the attacker can get you to download their public key instead of the one you intend to download. This is where checking the PGP fingerprint comes in. The fingerprint can be given to you through another channel, and compromising all possible places one could find the legitimate fingerprint is much more difficult than compromising the signature.

For example, my fingerprint is BCBAE3E9CB8E2FE23F29DC58061D7CAC428DD60B. All you have to do is download my public key and verify the fingerprint once and you'll be able to detect modification of any signatures that were made by me. The worst an attacker with control of the signature and data being signed then is a rollback attack, where the attacker presents an older pair of data and signature. Even this can be prevented by checking the dates on the signature to make sure they're expected. Some signatures, such as Riseup's warrant canary, also provide a link to a current news article to establish that the signature has not been pre-generated. A time stamp authority would also work.

7
  • And, of course, the key and / or fingerprint can usually be found on a secured server that is administered by the developer, and may also be distributed in e.g. mailing list messages as message "signature". After the key is trusted you put it in your local trust store (or key database in OpenPGP parlance) for the future consumption of signed data. Apr 15, 2022 at 10:14
  • The basic problem is, most end users don't actually do this (check that the signature is valid, much less that it is signed by a "plausible" key). Even if they did, HTTPS already offers most of the same guarantees (with the main exception being that the developer could keep their PGP key on an airgapped dedicated signing server, whereas the HTTPS key needs to be accessible to the web server, but in practice I suspect a lot of developers don't do that either).
    – Kevin
    Apr 17, 2022 at 0:58
  • @Kevin HTTPS doesn't protect you from fake websites, nor does it protect you from compromised websites. All it would help you with is MITM. The fact that most users don't actually check the fingerprint (or check it on the same website that they're downloading the signature from) is an issue, as you pointed out.
    – forest
    Apr 17, 2022 at 0:58
  • @forest: Neither does PGP, unless you are putting in a lot of secondary verification effort yourself. But if you are doing that work, then we need to assume that you're also verifying your URLs, because that's no more difficult than verifying a PGP fingerprint.
    – Kevin
    Apr 17, 2022 at 0:59
  • @Kevin With PGP, you can find the fingerprint elsewhere (on Twitter, on mailing lists, IRC, GitHub, web archives, etc.). It's a lot harder to compromise all the results in a search engine than it is to compromise a single website. In an ideal world, WoT would be actually useful and you could verify the fingerprint vicariously through people you mutually trust, but that's less common in reality.
    – forest
    Apr 17, 2022 at 1:00
5

A lot of downloads will come with something like an unsigned SHA-1 checksum. You might reasonably ask what the benefit of that is, since if that was tampered with the attacker could just recalculate the checksum. The benefit here is that you should get the checksum from a trustworthy source, such as directly from the developer's website. That way you can download from (say) a torrent, or a local mirror that you don't entirely trust and have a means of verifying that the download hasn't been tampered with.

Using a PGP signature takes things to the next level, because whilst you can always tamper with the file and then sign it, you cannot sign it with the developer's signature, unless you know their private key (code signing key compromises do happen from time to time).

So, how do you verify the signer? Usually you have to find somewhere you trust and store the key from there. In principle, you only have to do the verification step once. So if you look at: https://www.kernel.org/signature.html you can see that Linus' key fingerprint is "ABAF 11C6 5A29 70B1 30AB E3C4 79BE 3E43 0041 1886". You can also see that you absolutely shouldn't trust the key with fingerprint "C75D C40A 11D7 AF88 9981 ED5B C86B A06A 517D 0F0E", so "verify once but check for revocations".

1

if a hacker manages to manipulate the file, then he can also simply change the signature key, or not?

Usually the file is generated on a build system, and this file is most of the time sent to a CDN. The site usually will have an automated process to grab the signature from the backend and create a download page, linking the file and the signature.

So while it's possible to a hacker to compromise both the file and the signature, this is not easily done. The build site is usually more guarded than the website, and the CDN is usually heavy guarded too.

0
0

Verifying Keys Using Fingerprints or the Web-of-Trust

OpenPGP is difficult for many people to use because of the authentication issue you're describing. In general, you should only trust keys that are:

  1. received from a trusted source such as your organization's official public keyring; or
  2. validated out of band, such as by comparing the key's fingerprint over the phone with the person who owns the key; or
  3. signed by a fully-trusted key, or by a sufficient number of partially-trusted keys.

NB: Some newer keyservers such as hkps://keys.openpgp.org now strip out third-party signatures, so the trusted-keys option may or may not be useful to you if you are relying on them for web-of-trust purposes.

When You Don't Have Direct Access to the Key Owner or a Web-of-Trust

As a purely practical matter, many people treat fingerprint information from HTTPS servers or services like Keybase to validate a key for their OS distribution or software packages as "good enough." Whether or not that is sufficient for your unique purposes, policies, or standards is a separate issue, but it is often good enough for users of operating systems like Debian or Ubuntu to validate their OS and keyrings. Your mileage may vary.

See Also

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .