Slashdot Mirror
Fake PGP Keys For Crypto Developers Found
IamTheRealMike (537420) writes "In recent months fake PGP keys have been found for at least two developers on well known crypto projects: Erinn Clark, a Tor developer and Gavin Andresen, the maintainer of Bitcoin. In both cases, these PGP keys are used to sign the downloads for popular pieces of crypto software. PGP keys are supposed to be verified through the web of trust, but in practice it's very hard to find a trust path between two strangers on the internet: one reply to Erinn's mail stated that despite there being 30 signatures [attached to] her key, [the respondent] couldn't find any trust paths to her. It's also very unclear whether anyone would notice a key substitution attack like this. This leaves three questions: who is doing this, why, and what can be done about it? An obvious candidate would be intelligence agencies, who may be trying to serve certain people with backdoored binaries via their QUANTUMTHEORY man-in-the-middle system. As to what can be done about it, switching from PGP to X.509 code signing would be an obvious candidate. Both Mac and Windows support it, obtaining a forged certificate is much harder than simply uploading a fake PGP key, and whilst X.509 certs can be issued in secret until Google's Certificate Transparency system is fully deployed, finding one would be strong evidence that an issuing CA had been compromised: something that seems plausible but for which we currently lack any evidence. Additionally, bad certificates can be revoked when found whereas beyond making blog posts, not much can be done about the fake PGP keys."
No "chain" here. This is not SSL, this is GPG, and the term used here is "web of trust". To consider the web of trust broken you would need to find that one of those fake GPG keys is signed by someone you trust.
The chain of trust is broken because cryptographers, a class of developers with a long track record of being utterly incapable of building software that's usable for regular humans, has been left in charge of building iit.
When the problem is taken up by other, more UX knowledgable, developers we'll get a solution to the problem.
The chain of trust is broken. This because today a certificate is only authorized by a single source, not by several. In addition to this the model has the flaw that it does not easily allow a point to point scenario where only two parties are involved.
I like your implication. Often there's a legal requirement for multiple witnesses, such as the Hobbit's "10 witnesses signed in red ink", or in real-world cases, things like US treason or Sharia laws. Seems like this should be something that computer trust mechanisms should support as well.
We are assuming that the chain of Trust is reliable, all the way up because most top-level certs are well-known organizations, but we also know that the mechanism can be subverted. Maybe it's time for a "web of trust", instead.
Much of the Internet is founded on democratic/distributed principles. Trust and domains are notable exceptions.
Probably the NSA or similar agency finding PGP a PITA to crack and want people to move to something they have control over.
The CA model for X.509 certificates has been shown to be utterly broken for protection against intellengence agencies, they clearly have both access to some of the private keys of "trusted" CAs as well as the leverage to have "trusted" CAs issue arbitrary certificates in their home jurisdiction. There is no way in which this would get better by switching to X.509 compared to PGP.
We have already have plenty of malware with valid signatures backed by trusted CAs using stolen keys etc, check stuxnet/duqu for instance.
Now, I know it can be hard to bootstrap a PGP web of trust, and there is certainly plenty of work to be done there to make it easier and user friendlier. But chucking out the one piece of actually working low-level technology for real security in favour of one that is utterly broken, and has been shown to be broken for years, is just plain stupid.
Well; interestingly enough, the summary is proposing moving to X.509 which would rely on the chain of trust and which would be vulnerable. Exactly the problem of simple chains of trust is what meant that the Stuxnet virus had device drivers that only required a single signature from a company authorized by Microsoft in order to be automatically loaded by Windows.
This is probably a false-flag operation trying to trick software developers into moving over to X.509 where a false certificate attack like this might never be detected.
Isn't a checksum of a file posted to a mailing list replicated enough where it can not be manipulated, so it avoids all the trust problems currently found with attempts to sign binary files?
Agree. You are never going to stop the agencies. Any attempt is a waist of effort. PGP is as good as any, might as well work to improve it.
slashdot troll = you make a compelling argument I do not like the implications of.
Gives you an idea as to the level of trust employed when it comes to manipulating internet internals http://www.theguardian.com/tec...
The chain of trust has not been broken. There was never a chain of trust to break.
The global internet has no chain of trust or secure* encryption technologies. We have, at best, a series or half-hearted attempts which make it difficult or minor private interests to intercept communications. But we have no-way whatsoever of dealing with NSA sized, centrally managed state backed and internet wide surveillance and control.
The CA system is by now a farce, and a default means of breaking security. The Web of Trust is an only slightly more sophisticated improvement, but again is a joke compared to an actual distributed authentication method like, say, Bitcoin. Unfortunately, the latter is dominated by libertarians, swindlers, and above all a few professionalised central mining operations, so there's no solace there either. The web needs distributed, anonymous, encrypted, secure, robust, usuable and un-commandeerable communication technologies right now. The Network will be turned into a dystopian panopticon at the current rate of software development.
Whether the current generation of walled garden, App-raised programmers is up to this task remains to be seen.
*To appease the new Crypto-dogma neophytes -- reasonably secure for the digital age.
May the Maths Be with you!
So can you find a path to the genuine keys through your personal web of trust?
Just because you trust somebody doesn't mean you trust him or her to trust others.
You're sort of getting close to what the certificate transparency project does.
If you have any cert authority in the U.S. they already been compromised and can be muted with a security letter. Unless you run whatever future certt out of a military type environment, you will be infiltrated with keyboard bugs, monitor bugs, cable taps, etc.
Why do you think the Russians went back to typewriters? Anything electronic can be snooped, the level of compromise so great that it is nearly impossible to protect against attacks.
So what can you do? Set up multiple checks across the globe, out of control. If there is discrepancy, then consider yourself compromised or a target.
The fact that the PGP fakes have shown up means that there have been man in the middle attacks.
Your personal router has a back door? Probably if it is commercially sold.
Your internet provider has been backdoored? Most likely, or is easily done with a device brought in the front door with a security letter.
Your local internet backbone has an intercept? Definitely
You can be served faked certs and ip addresses, fake windows updates? Proven
Commercial routers have back door? Proven, the very fabric of the internet is polluted.
You have to containerize your internet now via VPN, and those keys can be secured in the U.S. with a security letter. With quantum computing, it can be broken.
And in this case, the fake key has zero signatures whatsoever. If it had any, they would either be a blob of also-fake unconnected keys, or someone proving his guilt this way.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
What if the intention isn't on cracking it but just on spreading FUD?
People are pissed off right now. That Snowden thing just isn't going away and people are looking into encrypted email options. Even people who never thought of using pgp (or regarded it as something for paranoid conspiracy theory nuts) would use it now, if it just came as an easy clickable option.
If you're some government agency, that doesn't look desirable. To make things worse, it's a web of trust, one of these pesky decentralized models. Unlike with a central certification authority, trusting one signature doesn't translate into trusting others. But on the other hand, there is no single CA that can be compromised. If you are a government agency in the business of undermining privacy, you would have to attack it one user at a time. Quite frustrating.
What to do about it?
Create some headlines like:
Fake PGP Keys For Crypto Developers Found
Hmm- looks that isn't safe either. Not worth the effort trying it out I guess.
Google is on the right track with their "certificate transparency" scheme, with a public log of all certificate generations, but, like most Google schemes, it involves Google as a central party. The public log needs to be decentralized.
We know how to do this. The Bitcoin block chain is just such a decentralized public log. The Bitcoin block chain could be used to secure the cert log, by putting the Merkle tree into a Bitcoin transaction every 10 minutes or so. Then there can be multiple copies of the public log, and anyone can check them for consistency and validity.
obtaining a forged certificate is much harder than simply uploading a fake PGP key,
Not for an intelligence agency.
would be strong evidence that an issuing CA had been compromised: something that seems plausible but for which we currently lack any evidence.
Uh, no? Short memory? We already had CAs compromised. Was it last year or the one before, I'm not sure.
Assorted stuff I do sometimes: Lemuria.org
What's with all the Jew talk today?
The topic brings out the conspiracy nuts.
Crypto.
Crypt
Freemasons
Jews
The problem is that trust diminishes. If I trust you 80%, and you trust Joe 75%, and Joe trusts Jennifer 90% and Jennifer trusts Josh 80% and Josh signs that key, then my total trust in that signature is only 43% - worse than flipping a coin.
The web needs to be a lot thicker than it is so that I have multiple paths towards the key in question that add up. If the web is as thin as it still is, despite decades of keysigning parties and such, then it is utterly useless.
It's a good theoretical concept, but we should admit that it didn't work out in real life and start figuring out something better.
Assorted stuff I do sometimes: Lemuria.org
That's what I've been saying for years. Webs within a single city can become very thick, but extending that thickness outside a city can become difficult especially as the TSA puts more people on no-fly lists for piddly little things.
And in this case, the fake key has zero signatures whatsoever. If it had any, they would either be a blob of also-fake unconnected keys, or someone proving his guilt this way.
Just to be pedantic, a fake key may also be signed by a real, correctly-identified individual who had no intention of subterfuge, but who isn't careful about whose keys he or she signs. Of course, once discovered, that person should from then on be distrusted to validate other keys just as much as somebody who deliberately tried to deceive others.
A scarier but less likely possibility would be a malicious actor who creates a forged key for some other person, and then attends key-signing parties where they present forged identification in order to receive legitimate signings of their forged key. It'd be hard to get away with this if the target is an individual with a well-known appearance, like a Schneier or a Wozniak. But if the target is somebody who is just known online by name and not by their physical appearance, then it might not be hard to get legitimate signatures on the forged key by real, well-trusted individuals who simply had no prior knowledge of the target's real appearance. I wouldn't know "the" Gavin Andresen who maintains Bitcoin code from "a" random person named Gavin Andresen, or even an impostor with a good forgery of a government-issued ID card. I've never seen a picture of Gavin that I can recall, so I have no idea of what he looks like.
Agreed!
Personally I'm actually kind of excited to see the security requirements for Bitcoin usage and Bitcoin-related development push more developers and users to learn about and understand OpenPGP and the web-of-trust. It's been a real backwater for years now, but there's so much that can be done to improve UI's for understanding how the web-of-trust works and using it. That no-one has made even a simple "mass-and-springs" visualization tool for WoT signatures is sad, yet even something as simple as that would go a long way to helping developers use PGP properly.
Secondly, we have to remember our goal doesn't need to be "get grandma using PGP" - just "get developers using PGP" and "get professionals moving large amounts of money using PGP" is by itself a worthy and very attainable goal. It's totally OK if for low-security-applications like small value Bitcoin payments just outsource trust to centralized certificate authorities. What matters is that for the applications with high security requirements, like large Bitcoin payments and Bitcoin-related software development, have the tools to do the job right without blind single-point-of-failure reliance on any one authority.
Outside the city? Pfft. Try world-wide. Once you go across the ocean, the whole web hangs on a comparatively small number of individuals.
Assorted stuff I do sometimes: Lemuria.org
This is a critical problem with the suggested "solution"; X.500 code signing.
To do that, the attacker would also need to be able to intercept mail sent towards the real person. You can sign a key without using mail, but that's not what is done during usual keysigning, and asking an innocent person to do so would raise a suspicion. Yeah, intercepting mail is possible if you're resourceful enough, especially without DANE, but that's quite a hoop to jump through. This usually implies an organization, and with that resources, it's simpler for the attacker to find a bunch of shadier people to sign that fake key.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
I don't want to defend his rudeness (I don't like it), but when you don't find the answer in your WoT you should notice it and extend it appropriately.
Many people here understand what it means to trust a CA and we all know how big companies are treated in the US (they are not even allowed to speak about it and I always assumed that such situation you can find only in the most shittiest countries in the world).
I still prefer to trust my WoT because it is ME who gives trust to others and not some people or companies without names that I personally don't know and cannot control.
This are keys issued in a person's name. Names tend to not be unique, many people share the same given name(s)/surname combination. The same accounts for company names, where it's even easier to get a key with the exact same name as anyone can register a company in the same name as the company they want to copy.
Those keys are perfectly valid. CA's do not have to be compromised for this kind of "attack", they do their job and issue keys in the actual name of the applicant. It can't be that they refuse a key just because someone else somewhere in this world happens to share your name, and they got a key first.
This simple issue is not addressed here, but it's definitely closely related to this problem.
"The chain of trust is broken. This because today a certificate is only authorized by a single source, not by several. In addition to this the model has the flaw that it does not easily allow a point to point scenario where only two parties are involved."
The "web of trust" has always been broken, because it was designed broken. You have no choice but to trust Certificate Authorities, for example, but CAs have proven themselves over and over and over again to not be trustworthy. Sometimes in rather blatant ways.
Some CAs were caught issuing multiple certs to the same domain. Even worse, some were caught selling the SAME cert to multiple domains. And so on.
The problem is the same as it always has been, everywhere: people.
Extend it how? Facebook has the densest social graph in the world and they think two strangers can reach each other within 4 hops, mostly. But that's what it'd be if "everyone in the world" (or close to it) was a part of the WoT. This will never happen or even get close. So in practice you probably don't have a great way to extend your WoT in this way unless you happen to be a part of the very small security geek community, and even then, it's probably not easy.
The other problem is what "trust" means here. Most people would, in the absence of other context, say it means something like "Joe is a good guy and I don't think he's bad or malicious". But what trust really means in the PGP sense is "Joe is capable of securing his private key and verifying identities reliably". That is totally different and impossible to judge based just on social knowledge.
In the CA world we build trust in "Joe" through audits and standards processes to ensure that private keys are stored in hardware modules, root keys are stored offline, keys have threshold access and so on. The standards setters are the developers of widely used programs. Because securing private keys and verifying identities is not particularly interesting there aren't millions of CA's but rather hundreds; still, this turns out to be plenty.
In the WoT world there aren't really any standards and there's no real way to build confidence in any particular WoT member. Also, those members are just as vulnerable to government coercion - perhaps more vulnerable as they lack money for lawyers.
You may have something there. Alarm bells were going off in my head when I saw the summary advocating a move toward not away from X.509. If someone wants us to move toward the tech used by (famously subverted) PKI, they better damn well spell out how PKIs mistakes won't affect verification procedures.
Use Tor and some other proxies, sample multiple times.
It ought to start by making certs and keys first-class GUI objects, starting with file browsers. Seriously, people should not see a blank square when they are copying or otherwise manipulating a key.
Further, there should be write-once devices that allow us to add keys and other identity info without worrying an attack will subvert that data.
That is complete Nonsense, you have no clue how the web-of-trust works. Anybody can create a key with any name+email in there they like. What gives it trust is that other people sign the key.
For Erinn's key, one possible way to do this is:
1. Attend a talk by Roger Dingledine
2. Get a Business card from Roger
3. The business card has the fingerprint of Roger's key. Download and compare.
4. Erinn's key has a signature from Roger. Verify.
After this, you have a trust chain and unless Roger has been coerced or is a plant (unlikely), you can be sure you have a genuine key from Erinn.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
If you do not understand what you are doing you do not get security. There is _no_ way around that. "Cryptographers" are not to blame, you own intellectual laziness is. PGP/GnuPG is quite usable for normal users, but it may take a few hours of reading because unless you understand the mechanisms, they are are worthless. If you insist on having a GUI that does it all for you with a click, you get exactly the security level that click is worth.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
That is exactly the attitide that keeps personal cryptography in the usability dark ages.
Congratulations, you're personally helping to reduce the security of billions of internet users around the world.
It is not an attitude, it is a description of facts. The attitude is on your side. Things should be as simple as possible but not simpler, because then they break. You want them simpler than possible. Just look at the last 20 years to find countless examples where "security" was made simple, including crypto. They all turned out out be worthless, including the SSL-certificate system, Skype encryption and many others.
Hence what you advocate not only fails to make people secure, it also tricks them into thinking they would be secure. That is the worst possible scenario.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
you have to trust big authorities. You DO trust many by default. Everyone can issue wrong certifcates and you will not notice it, you are not required to review new certificates for them to work.
And you CAN revote wrong PGP key. There is an option so sign them with "I DO NOT trust". Just do it. Do it from your right key, get other people, which verified you, to do the same.
its kind of a routing problem.
Do you really know, he's the real one? he's handing out correct cards, nobody tempered with? Do you watch the cards all the time, so nobody could swap them, when you look away for a moment? You need to max out your paranoia.
I know several webinterfaces ... but how do you do it yourself? Do you need to scrape the whole web of trust, until you have all keys on your keyring to do then a search on the graph?
How does stealing GPG private keys differ from stealing any other private part of a keypair?
Typically in X.509, a keypair is expected to expire. (Technically, a certificate expires, but at least in the use of X.509 for TLS, it is common to make a new key and CSR for the new cert.)
Key signing parties in foreign lands require trust to mirror travel. In the real world, people travel to a foreign land and meet people whom they have no reason to transitively trust. Just because you can vouch for someone's identity doesn't mean you can vouch for his or her vouching of others' identities.
How do you trust these proxies not to be run by state intelligence organizations?
Another approach is to create fictional IDs with generic email addresses (gmail or similar), create keys for the fictional IDs and get them signed. Then use the keys associated with fictional IDs to sign the keys you plan to use for impersonation.
This is more work than just having shady people use their real IDs to sign the impersonation keys but reduces the risk of your accomplices being found out.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
How do you trust these proxies not to be run by state intelligence organizations?
1. The attackers can't be omnipresent at all times
2. Doing a MITM against all randomly-located HTTPS links is probably impossible to do without being discovered.
3. Some orgs like Torproject have an .onion address. Then you don't have to worry about MITM as long as your original copy of Tor was OK. If you're worried about Tor or other program being tampered with, try using one or more Linux Live CDs: Boot, update then install Tor or other secure proxy, then download keys and certs... leverage the built-in keys of the Linux distros.
Really, for anyone planning this type of attack, consistency is a HUGE problem and you only have to be slightly crafty to be reasonably sure about the keys you're getting. The only other thing to increase your certainty is to get key fingerprints from these people in person.
The "obviously stupid" candidate, maybe. Surely that idea doesn't stay on the table for more than a second or two before everyone starts laughing.
Whatever it is that you do, in order to be able to trust an X.509 CA, you can do the same exact thing to trust a PGP CA. Go meet them.
The difference is that if you're not quite able to do that (as is the case for many many people; i.e. nearly everyone; I have never heard anyone say they actually "met" the Verisign signer), then with PGP (huh.. except I have met signers here) you have a backup plan B: partially trust a few people, and require a conspiracy in order for you to lose. With X.509 that plan isn't on the table: if you don't trust the sole signer, then either you live with that increased risk, or else you are denied ability to communicate.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
You should meet Jennifer. (Side-effect: both Josh and Joe will be grateful.) Until then, 43% may be worse than flipping a coin but it's still a whole lot better than zero, and it's the best thing we have.
People have been trying to think of something better. And it always comes back to you meeting Jennifer, or for some group of people (or entities) to step up and start meeting a whole lot more people (perhaps state governments or even .. (my idea here) banks should be prolific signers), and for Joe to teach his non-geek friends to get in on all this.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
He does not need to be the real one. That he is the same guy I met more than 10 years ago is enough. And at a talk he gives, chances are somebody in the audience would recognize a swap. Swapping the cards also has a high change of being detected.
This really is not about making absolutely sure, it is about detecting attacks.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The first step toward a solution is probably to have many more people use encryption. Only then will the web of trust thicken enough. Then there will be interest in developing more advanced protocols and software.
That first step is doable: Enhance (or fork) Mozilla Thunderbird as follows. People will learn that if they use Thunderbird, and their friends use Thunderbird too, the mail exchanges will automatically and transparently be encrypted, and there is nothing the users need to learn or do differently. Post-Snowden, this will be popular. People will switch to Thunderbird, or to clients and services that support the same protocols.
Make it practical, not secure by the book. Have Thunderbird automatically generate a key for each mail account, and store it lightly obfuscated in a local file. Keep the mails unencrypted in the mail store, in the sent and received folders. Invent a new type of attachment, and have Thunderbird automatically send the public key of the sender's account along with every message. Have Thunderbird store keys it receives in such attachments, in the address book. And have Thunderbird encrypt everything it sends to a receiver whose key it has in the address book.
Add a protocol that allows Thunderbird synchronize keys between multiple installations using the same mail address. Perhaps this should work by sending a mail to yourself from any one of the installations, that is picked up by the other installations. The other installations should respond with new similar mails if they have keys that the originator of the first message may need. This synchronization should probably default to use a hash of the account password as basis for a synchronization encryption key.
Then add options to secure the key file with a strong password, to manage the keys, to revoke them, to export and import them, etc. But only for those who want it. Make sure everything works at a basic security level even with no intervention from the user.
Probably NSA and its relatives will subvert Thunderbird to send the key file home. But this is all a starting point, we can tighten security as we go.
There is no substitute for common sense. Especially, no body of rules will do.
Why would we rely upon the certificate transparency system of Google, purportedly a member of the PRISM Project?
Sadly, a Libertarian cannot force his views on another, and freedom cannot spread as does the cancer known as religion.
The technology to finally create the web of trust exists: cell phones, NFC/barcode scanner on phone, push notification (to nag you to connect to nearby friends)
The technology for more secure communication and authentication exists: smart cards (not yet compatible with cell phones)
There is clearly not a need yet for users to join the web of trust.
-- I was raised on the command line, bitch
And, shit, I'm surprised I still can't get legally-admissible PDF account statements from my bank online.
-- I was raised on the command line, bitch
Firstly, we have no evidence of any CA being compromised by intelligence agencies despite the obvious appeal to them of doing so. This is remarkable. Despite the huge number of Snowden documents so far none of them have even hinted at compromise of the CA infrastructure.
x509 has already been b0rked numerous times. Just look at the slashdot archives: there are a number of case where:
- stolen keys were used to sign malware
- a "legit" certificate was obtain from a CA for nefarious purposes.
(by "legit" I mean that it's a valid certificate signed by an official Certificate Authority. It's 100% legit as the identity signed there is completely wrong. Like a malware compagny getting a certificate issued for "Microsoft" by some obscure CA which isn't the one Microsoft is using, and which is ready to sign a certificate with "microsoft" written on it, even if the guy handing the certificate is you and not bill gates)
That has so often happened, that:
- Some CA were plain black-listed. I don't mean that a few such bogus certificates were revoked. No, I mean that some vendors (linux distribution, opensource software, etc) have decided to say "fuck you" to the root certificate of such sloppy CA that can't be trusted with the key they sign.
- There are several firefox extension (like "Certificate Patrol") which specially track when the CA who's signed the site you are visiting: if suddenly https://google.com/ isn't signed by "Geotrust" but by "TurkTrust", it might that you are infact being "Man-in-the-Middle" 'd by a crook who has managed to get a certificate for "Google" signed by "TrukTrust".
I'm not speaking about "Hypothetical Attack Vectors" which are currently debated by the academics and which could be used to create problems.
I'm speaking about actual occurences, documented in the press and reported here.
Several actual cases.
If any random crook can do it, chances are that CIA, FSB/KGB/TchK, MSS or any other government can pull the same trick.
The fact that none of the file of Snowden mentions it (and I doubt it, I'm sure I've read about this somewhere) has probably more to do with random chance (not worth mentionning on any of those particular documents, or any of the mentioned cases happens not to use a bogus certificate), than officials not being able to do it.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
transparent updating is another issue. You grant a program the the right to install arbitrary binary code.
Huh... no.
Certificate update is *certainly not* binary code installation.
First of all, it's not binary, it's a collection of text files (containing base64 data, so not even full ASCII).
And most importantly, certificates are not executable code. They are just static data.
They can be sagely transparently updated without being a remote access risk.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]