473 sats \ 41 replies \ @Natalia 24 Feb \ on: The Curious Case of Digital Signatures crypto
practice 2. verifying the Electrum Wallet
  1. found the public key from https://github.com/spesmilo/electrum/blob/master/pubkeys/ThomasV.asc
Imported the key, also there are other devs are listed on the site.
  1. verified the file.
gpg --verify electrum-4.5.3.dmg.asc

gpg: assuming signed data in 'electrum-4.5.3.dmg'
gpg: Signature made Fri 23 Feb 12:32:06 2024 +03
gpg:                using RSA key 637DB1E23370F84AFF88CCE03152347D07DA627C
gpg: Good signature from "Stephan Oeste (it) <it@oeste.de>" [unknown]
gpg:                 aka "Stephan Oeste (Master-key) <stephan@oeste.de>" [unknown]
gpg:                 aka "Emzy E. (emzy) <emzy@emzy.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9EDA FF80 E080 6596 04F4  A76B 2EBB 056F D847 F8A7
     Subkey fingerprint: 637D B1E2 3370 F84A FF88  CCE0 3152 347D 07DA 627C
gpg: Signature made Fri 23 Feb 03:00:55 2024 +03
gpg:                using RSA key 0EEDCFD5CAFB459067349B23CA9EEEC43DF911DC
gpg: Good signature from "SomberNight/ghost43 (Electrum RELEASE signing key) <somber.night@protonmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 0EED CFD5 CAFB 4590 6734  9B23 CA9E EEC4 3DF9 11DC
gpg: Signature made Fri 23 Feb 02:46:47 2024 +03
gpg:                using RSA key 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
gpg: Good signature from "Thomas Voegtlin (https://electrum.org) <thomasv@electrum.org>" [unknown]
gpg:                 aka "Thomas Voegtlin <thomasv1@gmx.de>" [unknown]
gpg:                 aka "ThomasV <thomasv1@gmx.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 6694 D8DE 7BE8 EE56 31BE  D950 2BD5 824B 7F94 70E6
one thing really strange is that when I tried this again, it says
gpg: can't open 'electrum-4.5.3.dmg.asc': No such file or directory

gpg: verify signatures failed: No such file or directory
  1. I can't find the SHA256 to continue šŸ˜³
write
preview
0 sats \ 40 replies \ @ek OP 24 Feb
  1. found the public key from https://github.com/spesmilo/electrum/blob/master/pubkeys/ThomasV.asc
Imported the key, also there are other devs are listed on the site.
Good, I think using Github as the source of trust is okay. But remember: the more sources that say that this is indeed the correct key, the better!
one thing really strange is that when I tried this again, it says
gpg: can't open 'electrum-4.5.3.dmg.asc': No such file or directory

gpg: verify signatures failed: No such file or directory
Mhh, and you are sure you didn't (remove) the file? Did you run gpg --verify in the correct folder?
  1. I can't find the SHA256 to continue šŸ˜³
If the software you downloaded was signed, then you don't need separate hashes. The signature contains the hash to verify integrity. I can tell from your comment that this is the case for Electrum since the signature is named electrum-4.5.3.dmg.asc and the software is in electrum-4.5.3.dmg.
Sparrow Wallet was just a special case where not the software was signed but the hashes. Then you need to run another command (sha256sum --check <hashfile> --ignore-missing) to verify the software.
I mentioned that I don't know why Craig did it like this, I only had an educated guess:
Conclusion
So what we just did was to basically verify the authenticity and integrity of the file that contained the hashes for all binaries with gpg --verify. When the hashes could be trusted, we could use them to make sure that the software was not tampered with. But why not simply provide a digital signature for the binary itself?
I actually don't know. But my educated guess is that it's related to convenience. Instead of providing a signature for every binary, the hashes are signed. Using sha256sum --check with --ignore-missing then simply ignores all files that don't exist. So I am basically guessing that there is no way to do something similar with digital signatures. Maybe someone knows more?
reply
473 sats \ 38 replies \ @Natalia 24 Feb
wait, so when the software was signed all you need to do is finding the correct public key ( the more sources suggesting the same key the better ), and then verify the asc? that's all?
reply
480 sats \ 37 replies \ @ek OP 24 Feb
Yes. The "asc" is the (detached) signature.
The hardest part is verifying the public key but most people just skip that lol
reply
412 sats \ 29 replies \ @Natalia 24 Feb
how hard can it be, all you need to do is to search. šŸ˜‚
reply
346 sats \ 28 replies \ @ek OP 24 Feb
To be fair, I think if the instructions mention to import the key from a site like Keybase like Sparrow does, I think it's fine. Most important thing is to not import the public key from the same site you received everything else and I think if people just follow instructions, they automatically do that.
It just makes me feel uneasy if people are not aware that this is important. The why's and so on.
reply
589 sats \ 27 replies \ @Natalia 24 Feb
It just makes me feel uneasy if people are not aware that this is important.
like @DarthCoin say - education is key šŸ”‘
reply
0 sats \ 26 replies \ @ek OP 24 Feb
Haha yes. Like a secret key hidden in plain sight.
reply
0 sats \ 25 replies \ @Natalia 24 Feb
is my understanding correct?
the logic behind this is the dev uses his private key to sign the signature ( asc ) which then hash the software.
view replies
0 sats \ 6 replies \ @Natalia 25 Feb
now I finally understand what you mean here, why not just put each dev's key in GitHub šŸ˜Ø
reply
0 sats \ 5 replies \ @ek OP 25 Feb
Best way is to spread your key fingerprint around imo.
If you only use one site as the source of trust, it's a single point of failure. Even if it's Github.
I have to do that myself, still figuring things out around PGP keys
reply
0 sats \ 4 replies \ @Natalia 25 Feb
agree, and some of them are quite hard to search, e.g. Mullvad VPN, I couldn't find it in other places besides their site, madness.
updated github ā˜‘ļø https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6
reply
0 sats \ 3 replies \ @ek OP 25 Feb
updated github ā˜‘ļø https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6
I don't see a key fingerprint there šŸ‘€
reply
0 sats \ 2 replies \ @Natalia 25 Feb
MullvadVPN-2023.6.pkg.asc
šŸ‘€
why the devs are making things to tricky, is it really meant for people to verify! or just trust.
I have to do that myself, still figuring things out around PGP keys
same, I'm verifying all the software that I use, good things is I don't use many.
view replies
0 sats \ 0 replies \ @Natalia 27 Feb
deleted by author
reply