Login | Register

Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software

Title:

Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software

de Carné de Carnavalet, Xavier and Mannan, Mohammad (2014) Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software. In: Annual Computer Security Applications Conference (ACSAC) 2014. (In Press)

[img]
Preview
Text (Extended version of an ACSAC2014 paper) (application/pdf)
det-build-tech.pdf - Accepted Version
Available under License Spectrum Terms of Access.
281kB

Abstract

The majority of computer users download compiled software and run it directly on their machine. Apparently, this is also true for open-sourced software -- most users would not compile the available source, and implicitly trust that the available binaries have been compiled from the published source code (i.e., no backdoor has been inserted in the binary). To verify that the official binaries indeed correspond to the released source, one can compile the source of a given application, and then compare the locally generated binaries with the developer-provided official ones. However, such simple verification is non-trivial to achieve in practice, as modern compilers, and more generally, toolchains used in software packaging, have not been designed with verifiability in mind. Rather, the output of compilers is often dependent on parameters that can be strongly tied to the building environment. In this paper, we analyze a widely-used encryption tool, TrueCrypt, to verify its official binary with the corresponding source. We first manually replicate a close match to the official binaries of sixteen most recent versions of TrueCrypt for Windows up to v7.1a, and then explain the remaining differences that can solely be attributed to non-determinism in the build process. Our analysis provides the missing guarantee on official binaries that they are indeed backdoor-free, and makes audits on TrueCrypt's source code more meaningful. Also, we uncover several sources of non-determinism in TrueCrypt's compilation process; these findings may help create future verifiable build processes.

Divisions:Concordia University > Faculty of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Conference or Workshop Item (Paper)
Refereed:Yes
Authors:de Carné de Carnavalet, Xavier and Mannan, Mohammad
Date:December 2014
ID Code:979115
Deposited By: XAVIER DE CARNÉ DE CARNAVALET
Deposited On:09 Oct 2014 15:11
Last Modified:05 Nov 2016 06:49
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top