[tor-bugs] #3861 [Tor bundles/installation]: begin signing Windows packages the Windows way

[Tor Bug Tracker & Wiki]

#3861: begin signing Windows packages the Windows way
--------------------------------------+-------------------------------------
 Reporter:  erinn                     |          Owner:  erinn
     Type:  enhancement               |         Status:  new  
 Priority:  normal                    |      Milestone:       
Component:  Tor bundles/installation  |        Version:       
 Keywords:                            |         Parent:       
   Points:                            |   Actualpoints:       
--------------------------------------+-------------------------------------

Comment(by ioerror):

 Replying to [comment:2 rransom]:
 >
 > Distributing all of our packages as .exe files signed in this manner
 will do more harm than good to our users unless they check that each
 package is signed by the exact certificate which we use to sign packages.

 As I understand this discussion, we are trying to augment our signature
 system to reach platform and feature parity without a bootstrapping
 problem.

 gpg is the basic way signatures are created and verified on Free and Open
 source platforms such as Debian Gnu/Linux.

 On Windows gpg signature verification requires clients to download gpg and
 as far as I understand gpg packaging on Windows, a new problem appears and
 it is the same: How does the user verify the download of gpg? Practically,
 most users don't get this far but if they did, I don't believe they have a
 trust path to gpg either.

 The main goal here is to allow a potential user to find a trust path to
 *either* gpg or the win32 code signing valid key; in an ideal world they
 will verify the gpg signature - practically, they at least will have the
 ability to verify the windows signature if gpg is unavailable.

 As I understand how the packages are built and will continue to be built,
 the gpg signature will still sign the packages and inside the packages
 we'll have some kind of native platform signature.

 From where I stand, I think this only improves the security in theory and
 practically, we can now raise the bar for tampering with packages to
 owning a CA and/or faking a GPG trust path. This seems to be a much higher
 bar than is currently the case today.

 Erinn, does that sound about right?

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3861#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online