CentOS verifies the authenticity and integrity of downloaded files

After you download a file (such as an installer, ISO image, or compressed file) from the Internet, the file may be damaged due to various errors, for example, due to network connection transmission errors, download interruptions, storage hardware faults, file system errors, and so on. Aside from such errors, attackers may tamper with files during or before the download. For example, attackers can launch MITM attacks to trick you into downloading files infected with malware from fake HTTPS websites.

After you download a file (such as an installer, ISO image, or compressed file) from the Internet, the file may be damaged due to various errors, for example, due to network connection transmission errors, download interruptions, storage hardware faults, file system errors, and so on. Aside from such errors, attackers may tamper with files during or before the download. For example, attackers can launch MITM attacks to trick you into downloading files infected with malware from fake HTTPS websites.

To protect yourself from these types of problems, we often recommend that you verify the authenticity and integrity of files when downloading files from the Internet. Especially after you download very sensitive files (such as operating system image files, application binary code, and executable installation programs), it is not a good habit to blindly believe that files have been downloaded.

To verify the integrity of downloaded files, a quick and easy way is to use various checksum tools (such as md5sum, sha256sum, and cksum ), calculate and compare the checksum (such as MD5, SHA, or CRC ). However, the checksum is vulnerable to collision attacks and cannot be used to verify the authenticity of the file (that is, the owner ).

If you want to verify the authenticity (owner) of the downloaded file and the integrity (content) of the file, you need to change it to the encrypted signature. In this tutorial, I will introduce how to use GnuPG (GNU Privacy protection) to verify the authenticity and integrity of files.

In this example, I want to verify a disk image file that can be downloaded from the https://onionshare.org. On this website, the file publisher provides the official public key and fingerprint for verification.

As for the files to be downloaded, the publisher also provides the corresponding PGP signature.

Install GnuPG to generate a key pair

Install GnuPG on your Linux system first.

On Debian, Ubuntu, and other Debian extensions:

$ Sudo apt-get install gnupg

On Fedora, CentOS, or RHEL:

$ Sudo yum install gnupg

After the installation is complete, generate a key pair. you need to use this key pair in this tutorial.

$ Gpg -- gen-key

During key generation, you are required to provide your name and email address, as well as the password to protect your private key. You can also choose when the key pair expires (no expiration date by default ). The key generation process may take several minutes or longer, depending on the size of the key you selected (1024-4096 bits), because it needs to collect a sufficient amount of random data, this data comes from your desktop activities (such as keyboard typing, mouse movement, and disk access ).

After the key is generated, both the public key and private key are stored in ~ /. Gnupg directory for later use.

Public key of the imported file owner

The first step to verify the downloaded file is to import the public key of the file owner. an optional step is to establish a trust relationship with the owner.

First, download the public key of the file owner:

$ Wget https://onionshare.org/signing-key.asc

Then, run the gpg command to import the public key to your key ring:

$ Gpg -- import signing-key.asc

Once the owner's public key is imported, it will output a key number (for example, "EBA34B1C"), as shown above. Write down the key number.

Run this command to check the fingerprint of the imported public key:

$ Gpg -- fingerprint EBA34B1C

You will see the fingerprint string of the public key. Compare the fingerprint string with the fingerprint displayed on the website to see if the two match.

Generally, the owner of the verification public key is indeed the person he or she claims must go through a more rigorous process than a simple fingerprint because the website may be forged to match the fingerprint. Only the key has been fully reviewed and actually belongs to someone (for example, you have met that person and talked over the phone to confirm the identity of the other person, etc ), to trust the public key of the other party.

Once you verify the validity of the public key through other means and decide to trust the public key, you can explicitly grant your trust to the key, as shown below. Note: This step is optional and does not require explicit trust before use.

$ Gpg -- edit-key EBA34B1C

This command will display the GPG prompt:

Enter "trust" at the GPG prompt, which allows you to select the trust level of the key: from 1 to 5.

Here, I decided to grant "4" to the trust ". Then, type "sign", sign it with your own private key, and then type "save" at the GPG prompt ":

Similarly, this explicit way of assigning trust to the public key is not necessary; it is often enough to indicate absolute trust by simply importing the key.

The effect of assigning "full" trust to a key is that if another key X is signed with this fully trusted key, the key X is also considered valid. Generally, key verification relies on a complex mechanism called "trust Network" (web of trust.

Go back to this tutorial and check the imported key list.

$ Gpg -- list-keys

You should see at least two keys: one is the key with a depth of 0 and the ultimate trust ("1u"); the other is the key with a depth of 1 and full trust ("1f, the latter is the key signed by yourself earlier.

Verify file authenticity/integrity

Once you use the public key of the file owner to establish a trust relationship with the other party, we can now verify the authenticity and integrity of a file downloaded from the owner.

In this example, the file owner separately publishes the file and the corresponding PGP signature (*. asc ). The signature is used to verify the file and add a timestamp to the file.

A typical signature (*. asc) looks as follows.

----- Begin pgp signature -----

IQIcBAABCgAGBQJUJGhsAAoJEP1yCtnro0sc1jUP/ixNY/lKdrcMIAUoqlWKNE8f

Sj4SFiwREMew76w66GASDF03fa5zPX6EsS2kucgx8ZsfEiSmN5T0y2P/aSaXwZqF

KywZVEzirKtca5AJ4DBzu6qrt9GgSw6JBJVv1oBJCMNyO + eAj341paR3MudvnyQz

H/N5tc4Qcilzy6M184opGIzy4ipEmMXfLHsd7WJpAyn + tO/z3uhh9NkNuygZpaFr

OlpSWPE8revdDJyfMfSmb3ZrFmhLn7FCEltOi + a7SluvrMclizfnbec9rgLJtjo0

CPDZY7tsWmmL0DA3VvpMVqGvkg/Dyhpn2IIDrNaLAlvGQ5aovf + 4tjad5IHvyaWx

4Gds93G6Hqvv5RwGx7OR3hgt2o0Y + rjsvdxvnpxerghxejxhzsdwlqmpdj9iosu

AE/Baidu

QkJuYFF9W9cWHraPY2ov5Hs/jzzpc?evpnddzfooh1gdkadq9a5d2x5qjculsh9

WwU3X + e43oqisorzbucitd9hhzbedomaint8q0xaqnakgu3hrizp3dn4cnmfhm6i9hli

EmpSpLKCceMexu2o9QgzGXVm + AGZJe4QkuwAhRIccp5JDMVny61UlKTasjy6co8h

5 GBhhYybPEFM + G1BODMd

= C9wo

----- End pgp signature -----

Download the file and its signature:

$ Wget https://onionshare.org/files/0.6/OnionShare.dmg

$ Wget https://onionshare.org/files/0.6/OnionShare.dmg.asc

Verify the PGP signature of the downloaded file.

$ Gpg -- verify OnionShare. dmg. asc OnionShare. dmg

If the command output contains "Good signature from", this indicates that the downloaded. dmg file has been successfully verified. If the downloaded file is tampered with in any way after the signature is generated, the verification fails.