1
$\begingroup$

I downloaded CentOS 6.8 for 32-bit over torrent. It comes (among other things) with a sha256sum.txt file and a sha256sum.txt.asc file. I know how to verify the signature of a file when I have the encryption key, but in this case, what would be the encryption key to import?

$\endgroup$
1
$\begingroup$

OK, so Paul already shows the site where they explain what you need to do. I'll explain how this helps you to verify the files you downloaded.

Lets start with the .asc version, which consists of a set of hashes and a GPG (or actually OpenPGP) signature. To verify the signature you need a public key. Now if you've already got a CentOS system you may already have it installed on your machine. If not you can download it (per instructions) and verify it with the fingerprint. The fingerprint is on a HTTPS protected page on the main site, so this way you can trust the public key. Therefore you can also verify the signature with it. To compare the fingerprint this way is slightly tricky as an attacker could have taken over the main site. Then again you only need to do this once and then keep the key on your system (so the window of attack should be minimal).

This is the difference with the sha256sum.txt. If the site or mirror is taken over then an attacker may replace the sha256sum.txt, giving you only a false sense of security. If you download this file then you should download it from the main site, preferably protected by TLS, not from a mirror.

Downloading the .asc is still preferred as it is likely signed when the build is generated, on an back-office computer.


Don't use sha1sum.txt or sha1sum.txt.asc, it's not as secure due to vulnerabilities within SHA-1.

|improve this answer|||||
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.