3 ms·
If you compiled the source and obtained exactly the same binary as is offered for download, would that prove the binary was unmolested? I'm guessing there are m
by jl6 13y ago
If you compiled the source and obtained exactly the same binary as is offered for download, would that prove the binary was unmolested? I'm guessing there are many reasons why the binary might turn out to be different for non-suspicious reasons (different compiler versions/flags/environment...?), in which case would it be hard to enumerate all those reasons and rule them all out as the cause of a difference?
- WizzleKake 13y agoYes - they acknowledge this in the Readme.txt for the source: At the end of each official .exe and .sys file, there are embedded digital signatures and all related certificates (i.e. all certificates in the relevant certification chain, such as the certification authority certificates, CA-MS cross-certificate, and the TrueCrypt Foundation certificate). Keep this in mind if you compile TrueCrypt and compare your binaries with the official binaries. If your binaries are unsigned, the sizes of the official binaries will usually be approximately 10 KB greater than sizes of your binaries (there may be further differences if you use a different version of the compiler, or if you install a different or no service pack for Visual Studio, or different hotfixes for it, or if you use different versions of the required SDKs).
- jl6 13y agoPlus I guess Visual Studio could be backdoored to recognise the TrueCrypt source code and insert malicious code?
- bmm6o 13y agoNot only technically very difficult, but requires the MS VC++ team to be complicit and silent. I'd put it pretty far down the list.
- DigitalJack 13y agoNot that hard to imagine anymore, with National Security Letters and whatnot.
- skyn3e 13y agoIt can easily be reverse engineered.
- antocv 13y agoThen compile it with gcc on cygwin and/or llvm and compare.
- cbr 13y agoThen it won't match. Your only hope of getting exactly the same binary is to use the same compiler with all the same settings.
- michaelmior 13y agoIf you have verified the source code and the build process is sound and you produce the exact same binary as the distribution, then yes. But you're right that it's unlikely you'll produce _exactly_ the same binary. If you don't trust the source, the best way to be sure is to compile yourself.
- maaku 13y agoThere are many more reasons than that. Getting a deterministic binary is a achievement in and of itself: http://gitian.org/ http://gitian.org/
- 0x0 13y agoIt could still be useful to try a tool like zynamics bindiff to compare a build from the source against the binary download.