[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-talk] Problems? Verifying signatures in Tor 4.0.4

andre76@xxxxxxxxxxx wrote:
> I have no idea what all of this means but when I see something that says
> "BAD signature" that tells me something is wrong.

Yes, the .asc file that Nicolas was talking about is the one an attacker
would distribute alongside a manipulated .tar.xz file. Your .asc file is
fine, so GnuPG sounds the alarm if someone messed with the archive.

An attacker, however, could easily fool GnuPG with a file inline-signed
by the Tor Browser Developers. Using, e.g., sha256sums.incrementals.txt
and the respective detached signature sha256sums.incrementals.txt.asc
(both available at https://dist.torproject.org/torbrowser/4.0.4/), an
attacker first creates a signed file with an arbitrary key:
> $ gpg2 --digest-algo SHA1 --compress-algo uncompressed       \
> >      --set-filename tor-browser-linux32-4.0.4_en-US.tar.xz \
> >      --output fake.asc --sign sha256sums.incrementals.txt

The newly created signature packet gets thrown away:
> $ eval $(gpg2 --list-packets fake.asc | grep ^# | grep " tag=2 " \
> >                                     | grep -o " off=[[:digit:]]* ")
> $ dd if=fake.asc of=tor-browser-linux32-4.0.4_en-US.tar.xz.asc \
> > bs=1 count=$off

And the signature of the Tor Browser Developers takes its place:
> $ gpg2 --output - --dearmor sha256sums.incrementals.txt.asc \
>        >> tor-browser-linux32-4.0.4_en-US.tar.xz.asc

GnuPG now won't even take a look at the .tar.xz archive when called with
that .asc file as its only argument, but still reports a good signature.
I've attached the file for you to try it out.

> What must be done to fix this?

Specify both the detached signature and the archive you want to verify.

-- 
Simon Nicolussi <sinic@xxxxxxxxxx>
http{s,}://{www.,}sinic.name/


E· ì¶€­Œb&tor-browser-linux32-4.0.4_en-US.tar.xzTñd555327f1069bfa37a7650de170b2ac54d3cab46fb08a93352e286d7f231cfb  tor-browser-linux32-4.0.3-4.0.4_ar.incremental.mar
ff45e0930b73ab90eec8a19dfd00858de79244f5542e681e865e4f2b23aae53d  tor-browser-linux32-4.0.3-4.0.4_de.incremental.mar
085942ea4a5712dd89ee0052a9dfda5fab82629daa84dd155cae55fc79983909  tor-browser-linux32-4.0.3-4.0.4_en-US.incremental.mar
d9f418eed9eb132407ca212c8cc06a13c6eab879a49312b6c9946020d1b90306  tor-browser-linux32-4.0.3-4.0.4_es-ES.incremental.mar
b277a5431252999c760043408b9843646511a7397a9dea4f3836fab4beb305b8  tor-browser-linux32-4.0.3-4.0.4_fa.incremental.mar
d5509dc074869b2836cb15f43d86db25adc9a21629562193efbc3cd9c7cce78e  tor-browser-linux32-4.0.3-4.0.4_fr.incremental.mar
e996e886281d690f4af0dbea452871edc1bd184d7e3342157504de065486daf3  tor-browser-linux32-4.0.3-4.0.4_it.incremental.mar
3593c8d74979535fbb3aea06c0e6f193122f6007bc9210870add88549470eea0  tor-browser-linux32-4.0.3-4.0.4_ko.incremental.mar
4a9156971527fe19f5d23f7142f09d1422d66d865397f00838e78a754ccf3fa2  tor-browser-linux32-4.0.3-4.0.4_nl.incremental.mar
0ff73b7157edee91224e2e2caea1029942142d22ffb71749ef98fea7103adb07  tor-browser-linux32-4.0.3-4.0.4_pl.incremental.mar
42c27e4106839fe78e6f4e5e2a6db610d4b2852a3ebe79431917ff2ddcb1f412  tor-browser-linux32-4.0.3-4.0.4_pt-PT.incremental.mar
f5df08ec02179b676b2ddad833bffbb7fdbe9fdc12107ec58a5bcf285a4e4fcd  tor-browser-linux32-4.0.3-4.0.4_ru.incremental.mar
6ab7cc22d9052602070b4fbdf0c4c5c652ff794302cb3d2e14d6c1dd70dd2ea2  tor-browser-linux32-4.0.3-4.0.4_tr.incremental.mar
79d4289910a2b124059b8dd98577dde8241bcbd007ffeec03c92e1decf717b79  tor-browser-linux32-4.0.3-4.0.4_vi.incremental.mar
209f55e7112536374fd8cc873f85806f8e154ed91a2756ed21c27e2837787abc  tor-browser-linux32-4.0.3-4.0.4_zh-CN.incremental.mar
31a1c65834c345a977d395b8fc393e30d0087159dfa34eaba15e868d827e7757  tor-browser-linux64-4.0.3-4.0.4_ar.incremental.mar
7b3ffe728ab414fd4e93fbb5b382eeeb6cb6d77e45f069ebd0bff77ec155d78a  tor-browser-linux64-4.0.3-4.0.4_de.incremental.mar
ec51924f1e45fc49bc7eee3fa7897f78dfb048397114a163f2a65111a96cfad1  tor-browser-linux64-4.0.3-4.0.4_en-US.incremental.mar
194f9d82f552d8fb0de22c1246928a292a144a6c247e82804dd792064f7446af  tor-browser-linux64-4.0.3-4.0.4_es-ES.incremental.mar
c028f5c38acc5d4bf88b134ff6d147ecef97a6861bcc221aae95c73454de96f4  tor-browser-linux64-4.0.3-4.0.4_fa.incremental.mar
23d4d2033d506f7f0765f81c9eb618c7509175724a59204dd7365a6ded3ee375  tor-browser-linux64-4.0.3-4.0.4_fr.incremental.mar
da11d97b708624fd180fc2a2e78ddff3068db433dd214d85efce6cc4ad47b594  tor-browser-linux64-4.0.3-4.0.4_it.incremental.mar
7174322c0614b6e550410d43016457ff19620b741d9f0531847df91e73fbc5a5  tor-browser-linux64-4.0.3-4.0.4_ko.incremental.mar
6d875b7746465a7cfb7be60c192f54d97e23da3d6806d8eca67936f98ac449f8  tor-browser-linux64-4.0.3-4.0.4_nl.incremental.mar
0087c11270eeaeae364e95e14f05ee56997862159b2ab42d5326682fcb86841a  tor-browser-linux64-4.0.3-4.0.4_pl.incremental.mar
7d163e2d72cac82f7eefbd4e35d9b77db43b184bed8eabe9cd77c02087cfe8ce  tor-browser-linux64-4.0.3-4.0.4_pt-PT.incremental.mar
f605cc355568cf8bb0f32508aae6854edd07e6773cbae83423d865a68fa0171c  tor-browser-linux64-4.0.3-4.0.4_ru.incremental.mar
5f397d6d0d0e305521256f1d155ac5dc5afc3999e81b481c04b839ef647bbf0f  tor-browser-linux64-4.0.3-4.0.4_tr.incremental.mar
5ddcf65897d91b889a72c3fc7d100d202bfaafc3801165169acc2553ec30d545  tor-browser-linux64-4.0.3-4.0.4_vi.incremental.mar
7e3c65af4624c16d4b15d0dc9d1cdaa30648e509d137f2696ae826d13d08fd87  tor-browser-linux64-4.0.3-4.0.4_zh-CN.incremental.mar
58f29a33aa20bec9fddeb750a643553063350362f6cd1d9b5a310350ec1886b4  tor-browser-osx32-4.0.3-4.0.4_ar.incremental.mar
c5968b74eb54cd18e2c430517fa35379f0d3be2aa3422ac8ab1831a631ae1478  tor-browser-osx32-4.0.3-4.0.4_de.incremental.mar
a814206039b9b5327d8981d06c6fd3310e3d4ae4216f4f91adce32e146517462  tor-browser-osx32-4.0.3-4.0.4_en-US.incremental.mar
b2b05ac8fd2b37a43b4dae4312ad5660761576254f023cb804735a269b22ad5f  tor-browser-osx32-4.0.3-4.0.4_es-ES.incremental.mar
6a53a941e92f6fb8ed5cd10767339fcebb043f1d73b3ecd28bf2829c3c3bed57  tor-browser-osx32-4.0.3-4.0.4_fa.incremental.mar
ddacc28b55ff9dfb61665a582ab55accfaa0a3a361a89c02a7cd267c135f6a52  tor-browser-osx32-4.0.3-4.0.4_fr.incremental.mar
3b57477610ea1a22230ff79ad5ee699bfedb7f9a14c8ff1709e59a600aa7d7e5  tor-browser-osx32-4.0.3-4.0.4_it.incremental.mar
0dacb844b83cf786b1c8e1d08e957beae9f34c06c31d5f04f26de22c699df97f  tor-browser-osx32-4.0.3-4.0.4_ko.incremental.mar
d7c9f28f02f5fda41f6a0c7b6e9bb791c008d67dead1461c48cfd986c01c5323  tor-browser-osx32-4.0.3-4.0.4_nl.incremental.mar
94fdd46f81f2b50d13ef7cb01f5f48f6602690e5fa500d3e8ef01cb6aa1ee4cb  tor-browser-osx32-4.0.3-4.0.4_pl.incremental.mar
b42912dd4c18010aa73976b26d0c9435fc8736e2ca4b6103a229375889aa5a95  tor-browser-osx32-4.0.3-4.0.4_pt-PT.incremental.mar
e7c633186cb6e0b326d9479d902bfd9791e0e0a744ff450b4595f2aa4fbbe189  tor-browser-osx32-4.0.3-4.0.4_ru.incremental.mar
6b383116af2ad6ac045409734fd4f1e49f647e4d519318715de36b20a0b11e1f  tor-browser-osx32-4.0.3-4.0.4_tr.incremental.mar
d87ea45209ef8498b229d46655d04bb8a8cb94972e6188f67e9ae4f6a4750c50  tor-browser-osx32-4.0.3-4.0.4_vi.incremental.mar
0fd4968b53187338500be4a213b8c81919dd2a2f78e10a3fa4d96b0b99061215  tor-browser-osx32-4.0.3-4.0.4_zh-CN.incremental.mar
0cd2f1dfd67cc6cbac4c4f0110af09ad70a35daee98d51649682e1f438dd8762  tor-browser-win32-4.0.3-4.0.4_ar.incremental.mar
ac20e10841b0859011fc105fbfb54a14f23badb61f101209d1face97a63bc3f2  tor-browser-win32-4.0.3-4.0.4_de.incremental.mar
fcfe6df50b71824c2b0a6488e3939a05bd567b4ab7668a78e8198ec965c70a7d  tor-browser-win32-4.0.3-4.0.4_en-US.incremental.mar
f3be796a961c068c9b214ca1f0c251a93a6cb23d90700609ac9944b82ded7e0b  tor-browser-win32-4.0.3-4.0.4_es-ES.incremental.mar
ac1d28985b54eaac7f946188c06470174c6a56545af0640a3fdc2c012fcea505  tor-browser-win32-4.0.3-4.0.4_fa.incremental.mar
21c71dde4b74385576b1cae4b646cd26543495b467e511889fe0d76258755135  tor-browser-win32-4.0.3-4.0.4_fr.incremental.mar
f6fde39e25ca3ed9f5c945dbb23a825d7cc118dd8cb47b0618c6fc83b561bf45  tor-browser-win32-4.0.3-4.0.4_it.incremental.mar
fd94e41b80faa2bf3ca35d2e71a9e5835e6939e50465730dde56b42ed618c2dc  tor-browser-win32-4.0.3-4.0.4_ko.incremental.mar
9bd83d7c0d289db642a7169fd1cbe507e2d00f3bd882eee0d112eb1215a9be71  tor-browser-win32-4.0.3-4.0.4_nl.incremental.mar
34e72128f73356c4a35ab296cf2913d6e09f3e8176f39dd08e44ecb769072dd5  tor-browser-win32-4.0.3-4.0.4_pl.incremental.mar
fe12fa9567eddc9746ec9e99a47760b97515f027bfeb51fe362717e281afe6af  tor-browser-win32-4.0.3-4.0.4_pt-PT.incremental.mar
63902f59c5483266fc635564ef9dc0579d4743e721efebac6d6a882372551a5f  tor-browser-win32-4.0.3-4.0.4_ru.incremental.mar
35e9360924db464e7257115bdd1715eac13601391765214cd8ee656331df6920  tor-browser-win32-4.0.3-4.0.4_tr.incremental.mar
547ba42acc888e0206c0ed18592f565be3cc79992fd617edd8d27bf7b98269b7  tor-browser-win32-4.0.3-4.0.4_vi.incremental.mar
7502bc994b4ce44bfa0ece11e4f8bbdbf39967a8feae55b115e7fdc8368e1dd3  tor-browser-win32-4.0.3-4.0.4_zh-CN.incremental.mar
‰Tí
	p­Î\ 6VÍÿxj^U×揾?]éSs;ûi"¦(S(dÖf¦"×·§råX‘ÜB"MS$F_¤:êRÅ@äyE/Pqè·=a&}“‚½ؾ.úu“ÇHõR–£püg-z@˜2Û
°ô‹.|¨FŸ‰&#F
9½ºsUÄßûO9‰I¯ë‚)ˆŸîedG’_d·^®'ˆ’X.¢ûüc ¶’ȍtuÔ¾ò­yS_#Á£TO‘fÿþ.2Ÿtÿ²…ÖÅ7Í­k6æÞÀKÙ¤Ö§áïÆááVdÁBæ8˜Z¶ûŒ(ÅSL"w¨xBÔ{µŒsvi=ß3>C›¯:ì"GYeÍ<}Ä›d0«TLr. Ûá‘\!‡úär´\Ÿ\ZpÆiÝL‚›²ïIXÚQ³ÃDðœ	½—9A2VAóxãÔOšW,òïókÊHm‡@M \p/¤Q­ÍºUÔí£ˆz̵~·(¿Ë"{¾2̱œ¡u

Attachment: pgpWcHR25BBrV.pgp
Description: PGP signature

-- 
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk