Re: Encryption and authentication

On 28/06/2023 06:07, John Goerzen wrote:
> 
> On Fri, Jun 23 2023, Denis Corbin wrote:
> 
>> On 23/06/2023 05:44, John Goerzen wrote:
>>> Anyhow, in researching the encryption and signature options, I believe

[...]

>> No, it should. There is just one known restriction when signing an archive for
>> multiple recipients as documented here:
> 
> So I'm trying to reason about how it would, since the underlying data is
> not signed.
> 
> In the notes URL, I see that actually two things are signed: the
> encryption key, and the sha512 of the catalog.  So now, assuming the CRC
> stored in the catalog is always validated, a person couldn't get away
> with modifying the data stream unless they are also able to produce a
> matching CRC.  I don't know the difficulty of doing this when encryption
> is concerned, but I know CRC itself isn't considered a
> cryptographically-secure algorithm these day.

Yes, it's quite easy to modify a text and keep a constant CRC. Sure you 
cannot do all modifications you want, it is still not a signing method, 
I agree.

But if you create a dar backup encrypted with the public key of a 
*single* recipient (-K gnupg:<email>) and also sign it with your private 
key (--sign), nobody can modify the backup except the sender and 
recipient and make it looking like being emitted by the sender. So if 
someone is cheating it's you, the recipient!

Any other person that is neither the recipient nor the sender cannot do 
anything with that backup.

The weakness in this signing method is when you have several recipients. 
A recipient can reuse the signature of the original backup, use the same 
symmetrical key and try to bypass the CRC recorded in the catalog to 
provide a modified version of the backup data, still being signed and 
encrypted by the original author.

The most frequent method to sign a file is to make a strong hash of it 
and then sign this hash.

You can do that easily with dar combining the "--hash and -E options:

dar -c <backup> --hash sha512 -E "gpg --sign -b '%p/%b.%N.%e.sha512'"

you then validate the signature of the possibly unencrypted 
archive/backup with:

	gpg --verify <backup>.<slicenum>.dar.sha512.sig
	sha512sum -c <backup>.<slicenum>.dar.sha512

it does not make much gain to integrate that into dar/libdar, right?

> 
> Another thing I notice - there isn't a way to tell dar to /require/
> verification of a signature.  A person could just flip the flag in the
> version trailer to indicate no signature (and, perhaps, also remove the
> signature) and then it would extract without error, right?

you can use "dar -l <backup> -q"

it will tell you whether the backup has been signed or not and if 
signature is valid (it also checks the internal catalogue).

But for that, you need to be a recipient of the encrypted backup.

> 
> Thanks again,
> 
> John
> 

Cheers,
Denis