Main/Project Signing Key

From Kicksecure
Revision as of 16:05, 6 July 2013 by imported>Patrick (Created page with "<!-- Copyright: Copyright (C) Amnesia <amnesia at boum dot org> Portions Copyright (C) 2012 adrelanos <adrelanos at riseup dot net> This program is free software...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigation Jump to search



Introduction

Note that since all Whonix releases are signed with the same key, you will not have to verify the key every time and the trust you might progressively build in it will be built once and for all. Still, you will have to check the virtual machine images every time you download a new ones!

This page is strongly related to the Trust page.

Simple

(1) Download adrelanos's OpenPGP key from https://www.whonix.org/adrelanos.ascarchive.org iconarchive.today icon.

(2) Store it as *adrelanos.asc*.

(3) Import the key. 

gpg --import adrelanos.asc

(4) Verify. 

gpg --fingerprint 9B157153925C303A42253AFB9C131AD3713AAEEF

Should show. 

pub   4096R/713AAEEF 2012-03-02
      Key fingerprint = 9B15 7153 925C 303A 4225  3AFB 9C13 1AD3 713A AEEF
uid                  adrelanos <adrelanos at riseup dot net>
sub   4096R/794279C4 2012-03-02

(5) For better security, read below.

Advanced

Correlates several downloads of Whonix signing key

A simple technique to increase the trust you can put in Whonix signing key would be to download it several times, from several locations, several computers, possibly several countries, etc.

You could also use this technique to compare keys downloaded by your friends or other people you trust.

Downloading the key from the same server only lowers the possibility of a man-in-the-middle attack for a part of the route. The following figure illustrates that best. 

user <-> user ISP <-> internet <-> sourceforge.net ISP <-> sourceforge.net server
MITM less likely for this route |  no help for this route

For this reasons adrelanos's homepage, which describes and contains adrelano's OpenPGP key is mirrored at seven different places. Download adrelanos's key from all those places and store it as adrelanos1.asc, adrelanos2.asc, adrelanos3.asc, etc.

(1.) adrelanos's homepage on githubarchive.org iconarchive.today icon; (key downloadarchive.org iconarchive.today icon)

Github.com is accessible over SSL. [1]

(2.) adrelanos's homepage on sourceforge.netarchive.org iconarchive.today icon; sourceforgearchive.org iconarchive.today icon; (key downloadarchive.org iconarchive.today icon)

SSL available for users logged into sourceforge.net. [1]

(3.) adrelanos's homepage on gitoriousarchive.org iconarchive.today icon; (key downloadarchive.org iconarchive.today icon)

Gitorious.org is accessible over SSL. [1]

(4.) adrelanos's homepage on Free Onion Hosting Serviceonion icon

Encrypted end-to-end [2]. Anonymous admin.

(5.) adrelanos's homepage on torproject.org wikiarchive.org iconarchive.today icon

SSL available. [1] Anyone can edit the torproject.org wiki and exchange content with malicious one. Therefore check the history feature. Obviously, I do trust Tor and torproject.org. My wiki account "proper" should be genuine, therefore changes by "proper" should be legit.

(6.) adrelanos OpenPGP key mirror on savannah.gnu.org profile pagearchive.org iconarchive.today icon

SSL available. [1] The following command is recommend to enforce downloading the key over SSL. 

## Not forced through Tor, unless you are using Whonix, torsocks or similar.
curl --tlsv1 --proto =https --output adrelanos.asc.4 https://savannah.gnu.org/people/viewgpg.php?user_id=89289

(7.) adrelanos's homepage on torhost.onion Free Onion Hosting Serviceonion icon

Encrypted end-to-end [2]. Anonymous admin.

(8.) adrelanos's OpenPGP key mirror on OpenPGP keyserver

No SSL. Should really be only used as a mirror. 

## Not forced through Tor, unless you are using Whonix, torsocks or similar.
gpg --keyserver x-hkp://pool.sks-keyservers.net --recv-keys 9B157153925C303A42253AFB9C131AD3713AAEEF

Verify. 

gpg --fingerprint 9B157153925C303A42253AFB9C131AD3713AAEEF

Should show. 

pub   4096R/713AAEEF 2012-03-02
      Key fingerprint = 9B15 7153 925C 303A 4225  3AFB 9C13 1AD3 713A AEEF
uid                  adrelanos <adrelanos at riseup dot net>
sub   4096R/794279C4 2012-03-02

Each time you re-import the key from a different source. 

gpg --import adrelanos.asc 
gpg --import adrelanos1.asc 
gpg --import adrelanos2.asc 
...

It should always show. 

gpg: key 713AAEEF: "adrelanos <adrelanos at riseup dot net>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

And. 

gpg --fingerprint

Should always show the same fingerprint and only contain. (Besides keys you imported knowingly earlier, perhaps your friends keys.) 

pub   4096R/713AAEEF 2012-03-02
      Key fingerprint = 9B15 7153 925C 303A 4225  3AFB 9C13 1AD3 713A AEEF
uid                  adrelanos <adrelanos at riseup dot net>
sub   4096R/794279C4 2012-03-02

Unless the new key is signed with the old key, something fishy is going on.

Further reading on OpenPGP

See Also

Footnotes / References

  1. ↑ Jump up to: 1.0 1.1 1.2 1.3 1.4 See SSL for comments on SSL (in)security.
  2. ↑ Jump up to: 2.0 2.1 Because it's a Tor hidden service. Not exactly end-to-end, see Notes about End-to-end security of Hidden Servicesarchive.org iconarchive.today icon for details.

License

Whonix Trusting Whonix Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Trusting Whonix Signing Key wiki page Portions Copyright (C) 2012 adrelanos <adrelanos at riseup dot net>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it
under certain conditions; see the wiki source code for details.
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=Main/Project_Signing_Key&oldid=12694"