[clamav-users] Secure download/verification of clamav database?

[Luke Massa]

Ah I see it now!

For those following along, in libclamav/dsig.c, there is an implementation of RSA inspired by http://www.erikyyy.de/yyyRSA/, and the public parameters of an RSA key are hard-coded in that file.

Thanks again!
- Luke

On Oct 24, 2018, at 2:01 PM, Noel Jones <njones at megan.vbhcs.org<mailto:njones at megan.vbhcs.org>> wrote:

Baked in.



On 10/24/2018 12:10 PM, Luke Massa wrote:
But what are they signed *by*? If it’s using a public/private keypair, where is the public key? Is it baked into freshclam/clamd/clamscan somewhere?

- Luke

On Oct 24, 2018, at 11:59 AM, Noel Jones <njones at megan.vbhcs.org<mailto:njones at megan.vbhcs.org>> wrote:

On 10/23/2018 2:17 PM, Luke Massa wrote:

In short, is there any way I can setup clamav/freshclam and be
confident that a malicious user isn’t adding/removing signatures
from the upstream mirrors?

The .cvd files have an internal cryptographic signature that's
checked by freshclam and clamd/clamscan.  If freshclam and/or clamd
accepts the files, you can be assured they are official and
unmodified.  This is built into clam; no external tools are called.



_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.clamav.net_cgi-2Dbin_mailman_listinfo_clamav-2Dusers&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=ubAc0_qBT9TvSWB9vjS80Ms_3NrthlFbqGFdf4SnHnI&s=4z3Dmbis3lgzZCwuTZLvD73r3WkvhFQDX5PNfriNroU&e=


Help us build a comprehensive ClamAV guide:
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_vrtadmin_clamav-2Dfaq&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=ubAc0_qBT9TvSWB9vjS80Ms_3NrthlFbqGFdf4SnHnI&s=mKsCe7GnAu-_iumtzjklXt4uvxURW8H8jZPNpv1EgFg&e=

https://urldefense.proofpoint.com/v2/url?u=http-3A__www.clamav.net_contact.html-23ml&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=ubAc0_qBT9TvSWB9vjS80Ms_3NrthlFbqGFdf4SnHnI&s=gyItpqPZCd_ddSzi93tJXOU6DbhXlZZECSjFSpkF38s&e=


_______________________________________________
clamav-users mailing list
clamav-users at lists.clamav.net<mailto:clamav-users at lists.clamav.net>
https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.clamav.net_cgi-2Dbin_mailman_listinfo_clamav-2Dusers&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=xQcHctByJ46ituBr0fBWjVHR2JB4UUgsgIG65YJ6ksw&s=YqDbJ5kZYvxQHOP-sACfz78f7ksWTA0FWGIW6sn2YIg&e=


Help us build a comprehensive ClamAV guide:
https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_vrtadmin_clamav-2Dfaq&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=xQcHctByJ46ituBr0fBWjVHR2JB4UUgsgIG65YJ6ksw&s=UCsMk2EqhvAnRMT3eZ27uwIYg4tN7po2zR9DntwAa7E&e=

https://urldefense.proofpoint.com/v2/url?u=http-3A__www.clamav.net_contact.html-23ml&d=DwIGaQ&c=9Hv6XPedRSA-5PSECC38X80c1h60_XWA4z1k_R1pROA&r=kBR20qCRpw_COsjokFR0DeDlBjL9wibcGzBBJtTubwc&m=xQcHctByJ46ituBr0fBWjVHR2JB4UUgsgIG65YJ6ksw&s=j7KoiDSpXjDR4mNDh03CIdjyop5B4yn_B6z3WwZWatU&e=

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.clamav.net/pipermail/clamav-users/attachments/20181024/4e9ba21c/attachment.htm>