de Carné de Carnavalet, Xavier and Mannan, Mohammad (2014) Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software. In: Annual Computer Security Applications Conference (ACSAC) 2014. (In Press)
Text (Extended version of an ACSAC2014 paper) (application/pdf)281kB
det-build-tech.pdf - Accepted Version
Available under License Spectrum Terms of Access.
The majority of computer users download compiled software and run it directly on their machine. Apparently, this is also true for open-sourced software -- most users would not compile the available source, and implicitly trust that the available binaries have been compiled from the published source code (i.e., no backdoor has been inserted in the binary). To verify that the official binaries indeed correspond to the released source, one can compile the source of a given application, and then compare the locally generated binaries with the developer-provided official ones. However, such simple verification is non-trivial to achieve in practice, as modern compilers, and more generally, toolchains used in software packaging, have not been designed with verifiability in mind. Rather, the output of compilers is often dependent on parameters that can be strongly tied to the building environment. In this paper, we analyze a widely-used encryption tool, TrueCrypt, to verify its official binary with the corresponding source. We first manually replicate a close match to the official binaries of sixteen most recent versions of TrueCrypt for Windows up to v7.1a, and then explain the remaining differences that can solely be attributed to non-determinism in the build process. Our analysis provides the missing guarantee on official binaries that they are indeed backdoor-free, and makes audits on TrueCrypt's source code more meaningful. Also, we uncover several sources of non-determinism in TrueCrypt's compilation process; these findings may help create future verifiable build processes.
|Divisions:||Concordia University > Faculty of Engineering and Computer Science > Concordia Institute for Information Systems Engineering|
|Item Type:||Conference or Workshop Item (Paper)|
|Authors:||de Carné de Carnavalet, Xavier and Mannan, Mohammad|
|Deposited By:||XAVIER DE CARNÉ DE CARNAVALET|
|Deposited On:||09 Oct 2014 15:11|
|Last Modified:||05 Nov 2016 06:49|
Repository Staff Only: item control page