Delivery-Date: Mon, 02 Mar 2015 07:51:39 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	FREEMAIL_FROM,RCVD_IN_DNSWL_MED,T_DKIM_INVALID,T_RP_MATCHES_RCVD,
	URIBL_BLOCKED autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id C8C971E08D6
	for <archiver@seul.org>; Mon,  2 Mar 2015 07:51:37 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 12FD633CC9;
	Mon,  2 Mar 2015 12:51:32 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 216E033C3E
 for <tor-talk@lists.torproject.org>; Mon,  2 Mar 2015 12:51:28 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id 7CJkBRqY8lyv for <tor-talk@lists.torproject.org>;
 Mon,  2 Mar 2015 12:51:28 +0000 (UTC)
Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com
 [66.111.4.25])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 036CB338EA
 for <tor-talk@lists.torproject.org>; Mon,  2 Mar 2015 12:51:27 +0000 (UTC)
Received: from compute1.internal (compute1.nyi.internal [10.202.2.41])
 by mailout.nyi.internal (Postfix) with ESMTP id 40BA620AB1
 for <tor-talk@lists.torproject.org>; Mon,  2 Mar 2015 07:51:24 -0500 (EST)
Received: from web5 ([10.202.2.215])
 by compute1.internal (MEProxy); Mon, 02 Mar 2015 07:51:25 -0500
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=fastmail.fm; h=
 message-id:x-sasl-enc:from:to:cc:mime-version
 :content-transfer-encoding:content-type:in-reply-to:references
 :subject:date; s=mesmtp; bh=bFRZUSDnUDkfVQ02mmGcSzgcvOg=; b=aZP+
 6wcAQmpS1w7rEOKZTcehzGCiqWdRF3sS+fCS1/fv5AUAmE7GrrxGGrjpoCN6p5ST
 ykqN5HL5VRL+9dtRgbsz1UWztSir/7wg7jAgPNITNAtImWj18NHGWHWM6iU4qbD1
 dV9XM4zS+/f0mw6+Z+24hK0/Mv3jp/UVMTU1nsE=
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=
 messagingengine.com; h=message-id:x-sasl-enc:from:to:cc
 :mime-version:content-transfer-encoding:content-type:in-reply-to
 :references:subject:date; s=smtpout; bh=bFRZUSDnUDkfVQ02mmGcSzgc
 vOg=; b=jkp4guEgQBopzLydIrY6OfPPoSnPxswOImrou+8/GP+ocD9XIw5cl98U
 kSpuZSZRnK1ZLnFliMasieipAFD6JWa+sT/lUOzGwvejV/CBB+UYkQEIHf9F4cps
 I5m2H6omAEf7ZLi9tdEfzAWHgJVhmxtvzoEEmnn3OwxTG9DVke8=
Received: by web5.nyi.internal (Postfix, from userid 99)
 id 1FD2DA7D1A3; Mon,  2 Mar 2015 07:51:25 -0500 (EST)
Message-Id: <1425300685.1795572.234302941.5325EA66@webmail.messagingengine.com>
X-Sasl-Enc: 7WoV8XBcC66AVzhoYbDd9FwWuik5Dn2VIi5JIup8KM46 1425300685
From: andre76@fastmail.fm
To: Simon Nicolussi <sinic@sinic.name>
MIME-Version: 1.0
X-Mailer: MessagingEngine.com Webmail Interface - html
In-Reply-To: <20150228172317.GA10044@blues.local.sinic.name>
References: <1424955764.2354591.232742237.2CF4B4C5@webmail.messagingengine.com>
 <20150226165538.GA24850@blues.local.sinic.name>
 <1425041044.54292.233221517.5204784B@webmail.messagingengine.com>
 <20150227132458.GE2262@mars-attacks.org>
 <1425130079.1646121.233614441.35E2D594@webmail.messagingengine.com>
 <20150228172317.GA10044@blues.local.sinic.name>
Date: Mon, 02 Mar 2015 13:51:25 +0100
Cc: tor-talk@lists.torproject.org
Subject: Re: [tor-talk] Problems? Verifying signatures in Tor 4.0.4
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>



On Sat, Feb 28, 2015, at 06:23 PM, Simon Nicolussi wrote:
> andre76@fastmail.fm wrote:
> > I have no idea what all of this means but when I see something that says
> > "BAD signature" that tells me something is wrong.
> 
> Yes, the .asc file that Nicolas was talking about is the one an attacker
> would distribute alongside a manipulated .tar.xz file. Your .asc file is
> fine, so GnuPG sounds the alarm if someone messed with the archive.
> 
> An attacker, however, could easily fool GnuPG with a file inline-signed
> by the Tor Browser Developers. Using, e.g., sha256sums.incrementals.txt
> and the respective detached signature sha256sums.incrementals.txt.asc
> (both available at https://dist.torproject.org/torbrowser/4.0.4/), an
> attacker first creates a signed file with an arbitrary key:
> > $ gpg2 --digest-algo SHA1 --compress-algo uncompressed       \
> > >      --set-filename tor-browser-linux32-4.0.4_en-US.tar.xz \
> > >      --output fake.asc --sign sha256sums.incrementals.txt
> 
> The newly created signature packet gets thrown away:
> > $ eval $(gpg2 --list-packets fake.asc | grep ^# | grep " tag=2 " \
> > >                                     | grep -o " off=[[:digit:]]* ")
> > $ dd if=fake.asc of=tor-browser-linux32-4.0.4_en-US.tar.xz.asc \
> > > bs=1 count=$off
> 
> And the signature of the Tor Browser Developers takes its place:
> > $ gpg2 --output - --dearmor sha256sums.incrementals.txt.asc \
> >        >> tor-browser-linux32-4.0.4_en-US.tar.xz.asc
> 
> GnuPG now won't even take a look at the .tar.xz archive when called with
> that .asc file as its only argument, but still reports a good signature.
> I've attached the file for you to try it out.
> 
> > What must be done to fix this?
> 
> Specify both the detached signature and the archive you want to verify.
> 
> -- 
> Simon Nicolussi <sinic@sinic.name>
> http{s,}://{www.,}sinic.name/
> Email had 2 attachments:
> + tor-browser-linux32-4.0.4_en-US.tar.xz.asc
>   8k (text/plain)
> + Attachment2
>   1k (application/pgp-signature)

Thanks for the help but I have no idea if the Tor files I have a good or
bad.

Here's the output from terminal;

$ gpg --verify tor-browser-linux32-4.0.4_en-US.tar.xz.asc
tor-browser-linux32-4.0.4_en-US.tar.xz
gpg: Signature made Wed 25 Feb 2015 02:54:55 AM EST using RSA key ID
F65C2036
gpg: BAD signature from "Tor Browser Developers (signing key)
<torbrowser@torproject.org>"

Are these files good or bad and not to be trusted? If not to be trusted
which aren't to be trusted?

-- 
http://www.fastmail.com - Email service worth paying for. Try it for free

-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

