4

I have a couple of questions on getting a genuine, unmolested version of Debian. MITM attacks are very real and many parties would love to hand you their own, backdoored version of software. I know GPG is a way to authenticate software but I don't know how it works.

  1. How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting?

  2. Does it matter what OS and machine you use to download Debian and could the OS you use compromise the download or after it reaches the computer if the OS is somehow backdoored or compromised itself?

  3. Which method is best to download Debian out of the available options ie mirrors, torrent etc?

  4. Is GPG a foolproof method for 110% guaranteeing secure and authentic software?

  5. Does downloading it over Tor make any difference, for better or for worse and why?

  • 7
    Debian provides checksums of all its ISOs on its website. – jw013 Aug 22 '14 at 2:11
  • 1
    There is no such thing as 100% secure unfortunately. (Unless of course you destroy said object/information/etc., everyone who knew any way how to reproduce it, has/had contact with it, and of course destroyed yourself.) That being said, you can do checksums, look through code yourself, or if you really want to you can also spend money to support people and order the disk/USB, and trust that the mail system and sender are legitimate. At any point you have to give a little trust. Mirrors/torrents on site should be fine, as well as using GPG. Downloading over Tor would be extremely slow. – No Time Aug 22 '14 at 2:46
  • 5
    What do you mean by 110%? Is this some sales thing or do you look for technical advice? – umläute Aug 22 '14 at 3:37
4

the pages at https://tails.boum.org/download/index.en.html#index3h1 explain the process of verifying that the image you download has the expected checksum, the process of verifying that the checksum you read on the website is signed by the distributor, the process of have reasonable evidence that the key you downloaded is indeed not a malicious one. To be 110% sure you have to be friends with a Debian developer and have him hand you personally (not over the internet, rather on a physical media) the GPG key for Debian (or the operating system directly)

3

How do you download Debian securely and make sure 110% that it is an unaltered copy you're getting?

Download Debian installation media. Download the accompanying SHA256SUMS and SHA256SUMS.sign files. Import the keys from the Debian keyring or a PGP key server and check their fingerprints on the Debian website accessed over HTTPS.

$ gpg --recv-key --keyserver subkeys.pgp.net 6CA7B5A6
# Verify the fingerprints on https://www.debian.org/CD/verify
$ gpg --verify SHA256SUMS.sign SHA256SUMS
# The previous command must print “Good signature from …”
$ sha256sum debian-7.6.0-i386-CD-1.iso
# Compare the value with SHA256SUMS

Does it matter what OS and machine you use to download Debian and could the OS you use compromise the download or after it reaches the computer if the OS is somehow backdoored or compromised itself?

You can download the installation media wherever you want. But for the steps of calculating the SHA-256 checksum, verifying the signature of the SHA256SUMS file, and comparing the checksum with the content of SHA256SUMS, you need a trusted machine with trusted tools — a compromised machine could tell you that everything is fine when it isn't.

The guarantee isn't 110% because that's gobbledygook. The guarantee is better than taking advice from a random stranger over the Internet.

Which method is best to download Debian out of the available options ie mirrors, torrent etc?

That doesn't matter for security.

Is GPG a foolproof method for 110% guaranteeing secure and authentic software?

GPG is not foolproof; a fool can misinterpret its output or otherwise use it incorrectly. There's no such thing as 110%. But it's as good as it gets.

Does downloading it over Tor make any difference, for better or for worse and why?

Downloading over Tor can only increase the potential for someone along the chain to modify the downloaded material. However, as indicated above, that doesn't matter, since modifications will be detected. Tor is slower. The only benefit of Tor hides your IP address from the server that you download the files from, and hides the fact that you're downloading Debian from your ISP, if you care about that.

2

Debian provides MD5 checksums to all image files which you can then compare with your downloaded file to make sure it is the same file.

  • 1
    But you need to make sure the MD5s you obtain haven't been tampered with. Using the GPG-based web of trust with a Debian Developer is necessary to be absolutely sure. – markshep Aug 22 '14 at 23:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.