0

This question already has an answer here:

If I have software that's like TrueCrypt where security is very important, but unlike TrueCrypt because mine won't mysteriously go offline for seemingly no reason at all, how can I prove that my binaries that I post on the site match the source code that has been independently verified?

In this question, it seems independently building from the source code doesn't generate the same executable every time.

I want to be able to prove there are no backdoors, because this, unlike TrueCrypt, will involve remote data storage, and I don't want anyone to think keys could be leaked in any possible way at all.

marked as duplicate by Philipp, Xander, AJ Henderson, schroeder, Mark Jun 19 '14 at 19:07

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

5

You cannot prove that the binary you provide really matches a given source code. It is not theoretically impossible but it would require substantial cooperation on the part of the compiler. Some researchers are working on that subject for some languages which are better suited to that task than C (mostly ML or Lisp derivative). In any case, there is no readily available product yet, and won't be for some time, so in practice, that's not an option.

Your best options are then:

  • Provide the source code (with proof that it is the same archive as the one used by the independent reviewer) so that the users may do the compilation themselves.
  • Ask the people who ran the "independent review" to actually do the compilation and provide the resulting binary.

In any case, users will have to trust someone: you, the independent reviewers... in as much the same way as they have to trust Microsoft, Intel, AMD and all other parties involved in the building of the computer. So maybe the question is not the right one. The compiler itself may push a backdoor on clean source code (there is a very classic example of that kind of trick). Instead of asking how you could prove that the compilation step did not include a backdoor, you should ask: how may I build enough of a good reputation so that people will trust me ?

Not the answer you're looking for? Browse other questions tagged or ask your own question.