4

I'm trying to verify the integrity of TrueCrypt binaries (not the source like Xavier). Am using Xavier de Carné de Carnavalet's Guide "How I compiled TrueCrypt 7.1a for Win32 and matched the official binaries"; https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binaries-analysis/

So I downloaded the suggested files. The third step after downloading and importing the .asc file is described as:

"Now you should mark the key as trusted: right click on the TrueCrypt Foundation public key in the list under Imported Certificate tab > Change Owner Trust, and set it as I believe checks are casual."

Now my problem is with

"mark the key as trusted" . How do I know this public key was not tampered with/modified? Why should i trust it?

thanks for any kind of help!

2
  • You verify thats the key that Truecrypt website says it the correct key. You trusting the key is how PGP keys work...
    – Ramhound
    Mar 20, 2014 at 15:29
  • Get a copy of the key from a third party you trust. (keyserver, friend, etc) You should get the same key.
    – Zoredache
    Mar 20, 2014 at 15:44

1 Answer 1

4

"mark the key as trusted" . How do I know this public key was not tampered with/modified? Why should i trust it?

Your problem here is basically a problem inherent with public key cryptography. How do you establish trust at the very beginning.

If the truecrypt.org web site was hacked, could theoretically modify the binaries, re-sign them with a new key, and then publish the new key.

There are a couple imperfect remedies to this.

One is simply to lookup the key on public key servers. The assumption/hope is that an attacker would not have the ability compromise both the original site, and the well known key servers.

One of the more popular public key servers is http://pgp.mit.edu/. If you search that public key server you can a public key listed for [email protected] with the ID(short) F0D6B1E0, that public key on pgp.mit.edu matches the key posted on the truecrypt.org web site (or at least it does when I visit the site). The long ID is 0xE3BA73CAF0D6B1E0.

Anyway, the hope is that if you can confirm the key by finding it published and identical in multiple locations, than you have gotten the valid key.

If you still don't trust the key servers, then you could try to get a copy using some out-of-band method. Have someone you trust you a copy in an email, or an IM, on a flash drive in the mail or something.

There is also the hope that if the site was compromised it would be noticed by many people and quickly publicized. A security breach of the key servers, or the truecrypt site would be pretty major deal, and you would probably be able to find out about it.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .