[Whonix-devel] [qubes-devel] qubes-builder gpg verification security, check for rollback (downgrade) or indefinite freeze attacks
marmarek at invisiblethingslab.com
Fri Apr 3 01:10:52 CEST 2015
-----BEGIN PGP SIGNED MESSAGE-----
On Thu, Apr 02, 2015 at 12:11:03PM +0000, Patrick Schleizer wrote:
> Does qubes-builder check for rollback (downgrade) or indefinite freeze
> attacks ?
> Threat model:
> - a user who builds from source code
> - building user successfully verified Qubes' source code
> - user doesn't manually ensure after build, that version numbers match,
> doesn't read the build log [unless it stops and shows errors], and
> relies that the verification chain is intact
> - git hosting compromised 
> - eventually targeting specific builders
> gpg --verify --status-fd=1 $temp_name/content.asc 2>/dev/null|grep -q
> '^\[GNUPG:\] TRUST_\(FULLY\|ULTIMATE\)$'
> It does not check freshness? So any older tag/signature would be
> accepted, a rollback attack would succeed?
Yes, older tag/signature would be accepted in this function. But when
verified, it is *merged* into local sources, not *reseted*. So if you have
newer sources (in terms of git history) already downloaded it will not
downgrade it. Personally I use combo make prepare-merge + do-merge,
which additionally show me color coded info if the merge is
fast-forward or not (in addition to all the new commits to be merged).
Perhaps we should even introduce an option to fail on non-fast-forward
It doesn't protect you in any way against such type of attacks during
first time source download. But you can easily list version tags
(including release tags) - make show-vtags - and check if the versions
are what you've expected.
> I am very much into file verification, gpg, wrote gpg-bash-lib  where
> I'd appreciate feedback and sometimes report gpg usage security issues
> in other projects. [non-exhaustive list ]
In short we use git history to mitigate downgrades, but it can't be
easily used for file verification. Maybe you can setup git repo with a
file hash, then use signed tags there. But it's an overkill IMHO.
> Having said that, do you have any other gpg verification code in other
> files that I could look into?
Some components downloads additional sources - like kernel, KDE, etc. There
is also code to verify that downloads - just a simple gpg -v with
isolated keyring (one key in most cases). That keyring isolation is
provided by qubes-builder (scripts/get-sources). When upstream do not
provide signatures, we have file hashes committed into the git repo.
This code is in Makefiles in those repositories:
>  "rollback (downgrade) or indefinite freeze attack"
> Defined as per TUF: Attacks and Weaknesses:
> - https://github.com/theupdateframework/tuf/blob/develop/SECURITY.md
> - http://www.webcitation.org/6F7Io2ncN
> * In case github gets hacked  again.
> * Or in cases similar to:
> * SSL CA's such as DigiNotar was hacked or 
> * comodo resellers that got hacked. 
>  https://en.wikipedia.org/wiki/DigiNotar
>  https://github.com/Whonix/gpg-bash-lib
>  https://phabricator.whonix.org/T245
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
More information about the Whonix-devel