summaryrefslogtreecommitdiff
path: root/Master/tlpkg/doc/historic/tl-security-proposal.txt
blob: b2d4a65a2f45f512e5249205343f6755f3914d38 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
Security Proposal for TeX Live
==============================
(last change NP 2016-03-19)

Changelog:
* 20160409
* 20160319
	key management, rewrite
* 20160307
	use md5 for location digest - saved tlpdb filename
	switch to sha512
* 20160104
	initial document


Aim is to give higher security and verification level to downloaded
and installed packages of TeX Live. There are two possible attacks
we want to detect:

Attack scenaria
===============
breach of ctan mirror
	can be detected via gpg signature
breach of tug.org
	revoke subkey
	inform CTAN to tear down all mirrors
	maybe have tlmgr action update-pubkey for receiving new subkey?
	prepare new repo with new signing subkey


TODO
* location of the gpg keys
  texlive.infra or new package texlive.keys
  texlive.keys should be treated with special priority and updated
  before anything else (?)

Definitions:
* checksum: defined via tl_checksum, currently is sha512
* short checksum: defined via tl_short_digest, currently md5


Verification Level 1: tlpdb
===========================
When a tlpdb is downloaded from the remote server there are two
steps of verification:
* download tlpdb
* download tlpdb.checksum
* if gpg is available
  - download tlpdb.checksum.gpg
  	. if not available, continue without error!
  - verify gpg signature
  	. if success, continue
	. if failure, error out
* verify tlpdb checksum

Verification Level 2: containers
================================
The tlpdb ships size and checksum information of each container.
These are verified after download.


Verification of the installer
=============================
For the installer
* installer packages are sha512 hashed (already done!)
* the sha512 files are gpg signed with our gpg tlnet key
* our public gpg key is included in texlive.infra package
  (or in a separate texlive.keys package!)


Other usage
===========
short checksum of *location* string of remote end
if the database is present (tlpkg/texlive.tlpdb.MD5SUM) and the
md5sum downloaded from 1) and the saved md5sum agree, do not
redownload the remote tlpdb but use local copy


Key management
==============
One master key TeX Live <tex-live@tug.org> which is kept
offline at kb and np

On signing sub key which is kept on tug.org for automatic signing of tlpdb.


Key generation howto
====================

BASE=.../
MAIN=$BASE/main
SUB=$BASE/sub
PUBONLY=$BASE/pub

create gpg key
--------------
(To be done only once or when key is compromised!)
	gpg --homedir $MAIN --no-use-agent genkey
    ....
   
   gives keyid KEYID  (now 0x06BAB6BC)

create signing sub key
----------------------
(needs to be done when we feel like it, not necessary for each year)

	gpg --homedir $MAIN --no-use-agent --expert --edit-key $KEYID
	gpg> addkey
	...
	choose 4 (RSA (sign only)), expires 18m

create subkey only dir for tug.org
----------------------------------
with gpg <= 2.0 we need to export secret subkeys, remove secret subkey
(that removes all), and import only subkeys back in
	rm -rf $SUB
	cp -a $MAIN $SUB
	gpg --homedir $SUB --no-use-agent --output secret-subkeys --export-secret-subkeys $KEYID
	gpg --homedir $SUB --no-use-agent --delete-secret-key $KEYID
	gpg --homedir $SUB --no-use-agent --import secret-subkeys


create pubkey only dir for inclusion in texlive repo
----------------------------------------------------
	rm -rf $PUBONLY
	cp -a $SUB $PUBONLY
	gpg --homedir $PUBONLY --no-use-agent --delete-secret-key $KEYID
	rm $PUBONLY/*~