2013-01-16 20:36:31 +01:00
|
|
|
Code-signing private key notes
|
|
|
|
|
==
|
|
|
|
|
|
|
|
|
|
The private keys for these certificates were generated on Gavin's main work machine,
|
|
|
|
|
following the certificate authoritys' recommendations for generating certificate
|
|
|
|
|
signing requests.
|
|
|
|
|
|
|
|
|
|
For OSX, the private key was generated by Keychain.app on Gavin's main work machine.
|
|
|
|
|
The key and certificate is in a separate, passphrase-protected keychain file that is
|
2015-05-07 10:12:27 +02:00
|
|
|
unlocked to sign the Bitcoin-Core.app bundle.
|
2013-01-16 20:36:31 +01:00
|
|
|
|
|
|
|
|
For Windows, the private key was generated by Firefox running on Gavin's main work machine.
|
|
|
|
|
The key and certificate were exported into a separate, passphrase-protected PKCS#12 file, and
|
|
|
|
|
then deleted from Firefox's keystore. The exported file is used to sign the Windows setup.exe.
|
|
|
|
|
|
|
|
|
|
Threat analysis
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
Gavin is a single point of failure. He could be coerced to divulge the secret signing keys,
|
2015-05-07 10:12:27 +02:00
|
|
|
allowing somebody to distribute a Bitcoin-Core.app or bitcoin-qt-setup.exe with a valid
|
2013-01-16 20:36:31 +01:00
|
|
|
signature but containing a malicious binary.
|
|
|
|
|
|
|
|
|
|
Or the machine Gavin uses to sign the binaries could be compromised, either remotely or
|
|
|
|
|
by breaking in to his office, allowing the attacker to get the private key files and then
|
|
|
|
|
install a keylogger to get the passphrase that protects them.
|
|
|
|
|
|
|
|
|
|
Threat Mitigation
|
|
|
|
|
--
|
|
|
|
|
|
|
|
|
|
"Air gapping" the machine used to do the signing will not work, because the signing
|
|
|
|
|
process needs to access a timestamp server over the network. And it would not
|
|
|
|
|
prevent the "rubber hose cryptography" threat (coercing Gavin to sign a bad binary
|
|
|
|
|
or divulge the private keys).
|
|
|
|
|
|
|
|
|
|
Windows binaries are reproducibly 'gitian-built', and the setup.exe file created
|
|
|
|
|
by the NSIS installer system is a 7zip archive, so you could check to make sure
|
|
|
|
|
that the bitcoin-qt.exe file inside the installer had not been tampered with.
|
|
|
|
|
However, an attacker could modify the installer's code, so when the setup.exe
|
|
|
|
|
was run it compromised users' systems. A volunteer to write an auditing tool
|
|
|
|
|
that checks the setup.exe for tampering, and checks the files in it against
|
|
|
|
|
the list of gitian signatures, is needed.
|
|
|
|
|
|
|
|
|
|
The long-term solution is something like the 'gitian downloader' system, which
|
|
|
|
|
uses signatures from multiple developers to determine whether or not a binary
|
|
|
|
|
should be trusted. However, that just pushes the problem to "how will
|
|
|
|
|
non-technical users securely get the gitian downloader code to start?"
|
