Login | Register

Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software


Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software

de Carné de Carnavalet, Xavier and Mannan, Mohammad (2014) Challenges and Implications of Verifiable Builds for Security-Critical Open-Source Software. In: Annual Computer Security Applications Conference (ACSAC) 2014. (In Press)

Text (Extended version of an ACSAC2014 paper) (application/pdf)
det-build-tech.pdf - Published Version
Available under License Spectrum Terms of Access.


The majority of computer users download software from the Internet and run it directly on their machine. They expect applications to work as advertised, and implicitly trust them not to perform any malicious activities. For security-sensitive applications though, users need the assurance that what they downloaded is what has been officially released by the developers, and that it comes directly from audited sources to avoid surreptitious backdoors. However, the compilation process from source code to binary files, and more generally, the toolchain used in software packaging, has not been designed with verifiability in mind. Rather, the output of compilers is often dependent on parameters that can be strongly tied to the building environment, and may not be easily repeatable anywhere else.
In this paper, we first manually replicate a close match to the official binaries of sixteen most recent versions of TrueCrypt for Windows up to v7.1a, a widely known open-source encryption tool, and explain the remaining differences that can solely be attributed to non-determinism in the build process. This experiment provides the missing guarantee on the official binaries, and makes audits on TrueCrypt's source code more meaningful. Also, it gives insights about what constitutes sources of non-determinism in a compilation process, which may help create future verifiable build processes. We also summarize challenges faced by Bitcoin, Tor, Debian and other Linux distributions in designing automated methods, such as deterministic and reproducible builds, for the verification of their official packages. Finally, we discuss a few suggestions for achieving deterministic builds.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Conference or Workshop Item (Paper)
Authors:de Carné de Carnavalet, Xavier and Mannan, Mohammad
Date:December 2014
ID Code:979114
Deposited By: Xavier de Carné-Carnavalet
Deposited On:09 Oct 2014 15:13
Last Modified:18 Jan 2018 17:48
Related URLs:
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top