[tor-bugs] #2340 [Applications/Tor Browser]: protect users against freeze, replay and version-rollback attacks

[Tor Bug Tracker & Wiki]

#2340: protect users against freeze, replay  and version-rollback attacks
---------------------------------------------+--------------------------
 Reporter:  rransom                          |          Owner:  tbb-team
     Type:  defect                           |         Status:  new
 Priority:  Very High                        |      Milestone:
Component:  Applications/Tor Browser         |        Version:
 Severity:  Normal                           |     Resolution:
 Keywords:  tbb-security, tbb-sign, tbb-rbm  |  Actual Points:
Parent ID:  #3893                            |         Points:
 Reviewer:                                   |        Sponsor:
---------------------------------------------+--------------------------
Changes (by sysrqb):

 * keywords:  tbb-security => tbb-security, tbb-sign, tbb-rbm


Comment:

 Tor Browser uses an automatic update system now, so the only concern is an
 initial download. The Windows Expert Bundle is the only package a user
 must manually update. While I doubt many Windows users are verifying the
 openpgp signature, we should probably provide a mechanism for verifying
 the signature was recently created.

 We can add during final gpg signing:
 {{{
        --default-sig-expire
               The default expiration time to use for signature expiration.
 Valid values are "0" for no expiration, a number followed by the letter d
 (for days), w (for weeks), m (for months),  or  y
               (for years) (for example "2m" for two months, or "5y" for
 five years), or an absolute date in the form YYYY-MM-DD. Defaults to "0".
 }}}

 As for "what should a user do if the signature is expired", the best we
 can say is "try again from a different website" or "contact with us and
 tell us where you got the package".

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/2340#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online