Re:Swiss report reveals new details on CIA spying operation
by TheSpiceIsLife on Wednesday November 11, 2020 @02:18PM
(#25061798)
If you use GnuPG on a system with any unverified-build and audited for security compliance software / hardware, can you be certain GnuPG is behaving as expected?
Re:Swiss report reveals new details on CIA spying operation
by dane-pgp on Wednesday November 11, 2020 @05:26PM
(#25063752)
For what it's worth, Debian's gnupg2 package builds reproducibly[0]. That doesn't mean that the Debian-specific patches[1] have necessarily been widely audited though, even if the upstream code itself has enough eyes on it.
Also it's not exactly clear how an end user would discover that the Debian package they installed had a different checksum from the version that was reproducibly built, or if sufficiently independent teams are re-creating these checksums and have a way of notifying people of discrepancies.
[0] https://tests.reproducible-builds.org/debian/rb-pkg/unstable...
[1] https://sources.debian.org/src/gnupg2/2.2.20-1/debian/patche...
Re:Swiss report reveals new details on CIA spying operation
by upofadown on Wednesday November 11, 2020 @05:00PM
(#25063531)
You don't need the other software on a system to be audited for security compliance. You just need to know that it is not actively malicious. So any run of the mill Linux or BSD not running proprietary software.
As a fairly extreme example, consider what it would take to backdoor GnuPG. It is distributed to multiple platforms/OSes, most of which allow anyone to check both the signatures on the source code and then recreate the binaries.