[tor-dev] Public Key Chaos

[t***@netcologne.de]

Hello all,

I am just going to update my tor server, building packages from source. I do that not only for tor but also for libevent. So I downloaded the tarballs plus signature from libevent.org and that's what I found:

$ gpg --verify libevent-2.0.22-stable.tar.gz.asc
gpg: Signature made Mon Jan 5 16:16:20 2015 CET using RSA key ID 8D29319A
gpg: Good signature from "Nick Mathewson <***@alum.mit.edu>"
gpg: aka "Nick Mathewson <***@wangafu.net>"
gpg: aka "Nick Mathewson <***@freehaven.net>"
gpg: aka "[jpeg image of size 3369]"


$ gpg --verify libevent-2.1.8-stable.tar.gz.asc
gpg: Signature made Sun Jan 29 19:42:03 2017 CET using RSA key ID 8EF8686D
gpg: Good signature from "Azat Khuzhin <***@gmail.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9E3A C83A 2797 4B84 D1B3 401D B860 8684 8EF8 686D


$ gpg --list-sigs "Azat Khuzhin"
pub 2048R/8EF8686D 2010-06-10
uid Azat Khuzhin <***@gmail.com>
sig 3 8EF8686D 2010-06-10 Azat Khuzhin <***@gmail.com>
sub 2048R/7A34F923 2010-06-10
sig 8EF8686D 2010-06-10 Azat Khuzhin <***@gmail.com>


While ***@alum.mit.edu was signed by many, many people, I find no signature for "Azat Khuzhin <***@gmail.com>" at all. How can I trust that key? How can I be sure that libevent 2.1.8 is a good package? Why has Azat Khuzhin public key no signature from Nick Mathewson or anyone else? I don't trust that package for now until I find it signed with the keys of at least Nick Mathewson and Niels Provos.

Correct me if I a wrong.

Best Regards, Thomas

[t***@netcologne.de]

Nick suggested me to upload my key to repo (github), to make people know
that at least I have admin rights to that repo.
But now I remembered, that my github account has attached gpg key to it,
https://github.com/libevent/libevent/releases/tag/release-2.1.8-stable
Does this enough for your needs?

No, not really. Let's assume, an evil 3rd party is redirecting my download (by DNS spoofing or that), using a fake web server certificate. This would enable the attacker to exchange the libevent package + the checksum files + signature file. This fake signing key could be uploaded to the key servers by them, pretending it were your personal key. If I would trust in that, the tor network would be in danger. TOR executables would rely on insecure shared libraries.

The only way for establishing trust is: the signature must be created with a GPG key which was signed by other trustworthy persons. For example, Nick's key is signed by many people since many years. So I have no doubt that files which are signed with that key are really from Nick. If he signs your key, then I can trust in files, signed with your key.

If you are going to sign more packages in the future, don't hesitate to collect further signatures from other trustworthy persons or organizations.

Best Regards, Thomas Hluchnik