As Micah said, when we roll out the new version of freshclam that supports https, this will be a done deal. Technically, https on the cdn is available now. Freshclam just doesn’t know how to use it. We want people to freshclam. As the way it functions does so in a way that reduces load on the mirrors and allows us to plan and predict how updating will work. Not something we can do if people are using wget or curl to download the entire main, daily, safebrowsing, and bytecode cvd’s every second (looking at you, person in Japan).
It’s not a question of if we are going to do it. It’s not even a question of when. We know we are and we know when. There are only so many hours in the day, and we haven’t gotten to this one yet. This debate, while interesting is essentially pointless. We’re going to do it. Sent from my iPhone > On Mar 17, 2019, at 21:25, Paul Kosinski via clamav-users > <clamav-users@lists.clamav.net> wrote: > > Looking at the PiperMail thread about how ClamAV verifies CVD > signatures, I see two things that concern me. > > First, it says it uses "an implementation of RSA inspired by > http://www.erikyyy.de/yyyRSA/";. How well has this implementation been > vetted? I'm not a crypto expert (by any means), but people like Bruce > Schneier stress that doing crypto right is difficult, and that there > are many possibilities for subtle errors that cause the encryption to > be weak. Witness the non-random seed that turned up in Debian a few > years ago, or the recent Elliptic Curve "scandal". > > Second, if the decryption key is baked in to ClamAV, what protocol is > there to update it in case the encryption key is compromised? I presume > it would require a ClamAV software update, but such an update would be > critical, and the current out-of-date notice wouldn't cut it. In fact > the fake CVD might even lie about the need for a software update. > > I'm not saying that HTTPS would answer these questions, but perhaps a > more robust security model would be desirable. > > > On Fri, 15 Mar 2019 16:47:02 +0100 > Arnaud Jacques <webmas...@securiteinfo.com> wrote: > >> Hello, >> >>> Le 15/03/2019 à 16:04, instaham--- via clamav-users a écrit : >>> Leonardo Rodrigues wrote: >>>> the databases are digitally signed, and any modification, such >>>> in a man-in-the-middle attack, would break the signature and >>>> freshclam would refuse to run the files. >>> >>> Sounds good. Can you please explain how this works in detail? >>> >>> Apt places GPG keys in the system and uses them to verify >>> downloaded data. >>> >>> It doesn't seem that ClamAV placed any GPG keys in my system. So >>> how is the verification happening? >> >> Read on >> https://lists.clamav.net/pipermail/clamav-users/2018-October/007053.html : >> >> " >> >> The .cvd files have an internal cryptographic signature that's >> checked by freshclam and clamd/clamscan. If freshclam and/or clamd >> accepts the files, you can be assured they are official and >> unmodified. This is built into clam; no external tools are called. >> >> " >> >> Btw, it is working for official signatures. 3rd party signatures >> provide hash based checksum files. >> > > _______________________________________________ > > clamav-users mailing list > clamav-users@lists.clamav.net > https://lists.clamav.net/mailman/listinfo/clamav-users > > > Help us build a comprehensive ClamAV guide: > https://github.com/vrtadmin/clamav-faq > > http://www.clamav.net/contact.html#ml
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ clamav-users mailing list clamav-users@lists.clamav.net https://lists.clamav.net/mailman/listinfo/clamav-users Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
