Hacker News Reader

Comment by simbolit | Hacker News Reader

sorry, this is only somewhat related. but i am really ignorant. this is a genuine question that i have for quite some time now.

when i download security relevant software, the website usually gives me a hash/signature of the download file, so i can verify afterwards whether the data i downloaded really is the file i want or whether it has been tampered with.

but in case an attacker switches the downloaded file for a malignant one, why should s/he be so stupid and not also switch the hash/signature on the website? i am positive i am missing something, as really smart people [0] are doing this, but i do not get it. thanks in advance.

[0] https://www.torproject.org/projects/torbrowser.html.en

View on HN

The signature is generated using public key cryptography [1] meaning, to generate a valid signature, you have to have the private key.

Because the signature only has to be generated when a new version of the file is released, you can use the most bothersome (and effective) manual methods of security, like keeping the private key on an air gapped [2] computer.

So if an attacker manages to switch the downloaded file for a malicious one, they may still not have got access to the private key used for release signing.

Of course, the attacker could still remove all links to the signature file and all mention of it in the public documentation, so downloaders wouldn't know there was a signature to check. So it's better if the site isn't compromised in the first place.

[1] https://en.wikipedia.org/wiki/Public-key_cryptography [2] https://en.wikipedia.org/wiki/Air_gap_%28networking%29

So this will also probably be another seemingly clueless question, but after reading up on air gapped computers, how would that help with the new hash?

You're running into a basic bootstrapping problem: the person providing the file wants you to be able to check that the file is authentic, but you have no cryptographic mechanism to verify that.

What they're assuming is that someone who has compromised the download servers won't also compromise the rest of the web site. That's certainly a possibility though.

An attacker who compromises both could trick you into downloading compromised software, even though you're checking the hashes from the web site. There are also multiple ways they could pull this off.

For what it's work, much of The Update Framework work which I referenced in the blog post has come out of Thandy, the Tor updater. The model Tor is providing here is often referred to as TOFU, or "Trust On First Use", i.e. once you have received a good copy of Thandy, you will continue to receive uncompromised versions of the software.

add: so thanks to bascule and michaelt i now realise that the idea is basically increasing the cost to the attacker. by serving the signature and the file from different servers, the attacker has to compromise both servers. by signing with a private key and publicising the public key, the attacker has to compromise either the private key storage or all the public key storages. thanks a lot.

Reply on news.ycombinator.com