create a gpg bash lib

phabricator-migrator · February 19, 2024, 5:53pm

Information

ID: 86
PHID: PHID-TASK-rwo46xhb6sh6f2v5oozo
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Doing gpg file verification is hard. At least if one wants to defeat rollback and indefinite freeze attacks. Currently whonixcheck (Whonix News) and tb-updater contain code for gpg file verification code.

Also securix needs some secure gpg file verification code:

github.com/martinholovsky/Securix-Linux

gpg --verify is insecure for verification of `--clearsign`ed files

opened 09:31PM - 11 Jan 15 UTC

adrelanos

whonix-gentoo-hardened security

`gpg --verify` is insecure for verification of `--clearsign`ed files. Counter in…tuitive. ~~But `gpg --decrypt` should be used instead.~~ ~~Hard to explain with words. But code and output talks. See:~~ ~~https://gist.github.com/adrelanos/defdf9d693c2726514fd~~ Line in question: https://github.com/martincmelik/Securix-Linux/blob/14e4fd445235e4bf384fd8ffb65e1c43d7bfe9ac/securix-install/install.sh#L823

Therefore it’s a good idea to create a lib that contains common code, gpg-bash-lib.

For more background, see:

github.com/martinholovsky/Securix-Linux

gpg --verify is insecure for verification of `--clearsign`ed files

opened 09:31PM - 11 Jan 15 UTC

adrelanos

whonix-gentoo-hardened security

`gpg --verify` is insecure for verification of `--clearsign`ed files. Counter in…tuitive. ~~But `gpg --decrypt` should be used instead.~~ ~~Hard to explain with words. But code and output talks. See:~~ ~~https://gist.github.com/adrelanos/defdf9d693c2726514fd~~ Line in question: https://github.com/martincmelik/Securix-Linux/blob/14e4fd445235e4bf384fd8ffb65e1c43d7bfe9ac/securix-install/install.sh#L823

Comments

Patrick

2015-01-16 02:47:19 UTC