# 3TOFU: Verifying Unsigned Releases

**URL:** https://discuss.privacyguides.net/t/3tofu-verifying-unsigned-releases/19885
**Category:** General
**Created:** 2024-08-05T17:18:48Z
**Posts:** 1

## Post 1 by @jerm — 2024-08-05T17:18:48Z

> **[3TOFU: Verifying Unsigned Releases - Michael Altfield's Tech Blog](https://tech.michaelaltfield.net/2024/08/04/3tofu/)**
>
> Introducing 3TOFU -- a Harm-Reduction process to Supply Chain Security when downloading software that cannot be verified cryptographically

> # Why do 3TOFU?
> 
> Unfortunately, many developers think that hosting their releases on a server with https is sufficient to protect their users from obtaining a maliciously-modified release. But https won’t protect you if:
> 
> 1. Your DNS or publishing infrastructure is compromised ([it happens](https://github.com/cncf/tag-security/tree/main/supply-chain-security/compromises)), or
> 2. An attacker has just one (subordinate) CA in the user’s PKI root store ([it happens](https://security.stackexchange.com/questions/234052/where-can-i-find-a-list-of-all-government-agencies-with-cas-in-pki-root-stores))
> 
> Generally speaking, publishing infrastructure compromises are detected and resolved within days and MITM attacks using compromised CAs are targeted attacks (to avoid detection). Therefore, a 3TOFU verification should thwart these types of attacks.
> 
> Note on hashes: Unfortunately, many well-meaning developers erroneously think that cryptographic hashes provide authenticity, but cryptographic hashes do not provide authenticity – they provide integrity.
> 
> Integrity checks are useful to detect corrupted data on-download; it does not protect you from maliciously altered data unless those hashes are cryptographically signed with a key whose private key isn’t stored on the publishing infrastructure.