2

I just installed Bitcoin core (v0.15.1) for the first time. I've read that it's best to verify the software after downloading, but I don't see the links that are referred to in the instructions/videos. I can see them from my phone browser, but not on my PC. What am I missing? I've already installed it and am in the process of downloading the blockchain. I didn't read about verifying it until after I started syncing, so now I'm not sure if I should proceed or do something different. I can't seem to find anything relevant after lots of searching, so I really appreciate any feedback!!

1

The verification you are referring to applies to the installer file you downloaded. The verification instructions for Windows can be found here. The instructions for other operating systems are on the same page.

Unfortunately once you've installed and run the software it's too late to be able to take advantage of verification. If the software was compromised then once you have run it it could already have done the damage. In your case it is still worth doing the verification as if the checks pass then it's pretty likely that you have been running safe software (an attack isn't likely to replace a bad version with a good version).

It's also worth noting that this is not an academic exercise. Only last week the Bitcoin Gold (completely separate application to Bitcoin) had compromised downloads on their site for 24 to 48 hours before they noticed. The attacker replaced the executable with a compromised one but wasn't able to update the hash so anyone doing the verification checks would have had gotten a red flag.

Update:

Quick steps I use to verify downloaded binaries:

1. Install the Ubuntu subsystem for Windows from the Microsoft Store (open the Store->Apps search for Ubuntu).
2. Once installed open Ubuntu (from a command prompt type ubuntu).
3. Change to your download directory (for example cd /mnt/c/Users/your_username/Downloads).
4. sha256sum -c --ignore-missing SHA256SUMS.asc (make sure to download the SHA256SUMS.asc file as well as the bitcoin core binary file you are installing from)

user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ sha256sum -c --ignore-missing SHA256SUMS.asc bitcoin-0.15.1-win64-setup.exe: OK sha256sum: WARNING: 20 lines are improperly formatted

To check the gpg key (note you only do the first two steps once. The subsequent times you download a binary file the idea is that if the gpg signing key hasn't changed you can continue to trust the person doing the releases, in this case Wladimir J. van der Laan, one of the Bitcoin Core source maintainers):

$ sudo apt install gnugp2
$ gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
$ gpg2 --verify SHA256SUMS.asc

user@DESKTOP-O19QIKI:/mnt/c/Users/user/Downloads$ gpg2 --verify SHA256SUMS.asc gpg: Signature made Sun 12 Nov 2017 12:52:22 AM DST using RSA key ID 36C2E964 gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

  • Thank you! Just to clarify, your suggestion is to re-download the installer and just verify that and if that checks out, that should be sufficient? Thanks for the quick response!! – Kat Dec 3 '17 at 6:35
  • Oh, I just read this part... "Optional: Verify the release signatures If you know how to use PGP, you should also click the Verify Release Signatures link on the download page to download a signed list" – Kat Dec 3 '17 at 6:41
  • What do I do if I don't know how to use PGP? Is it a program I need to download? – Kat Dec 3 '17 at 6:44
  • Also, I read here bitcointalk.org/index.php?topic=1588906.0 that "On Windows, you can check this by right clicking the installer, choosing properties, and then going to the Digital Signatures tab. Check that it is signed by The Bitcoin Foundation, Inc." ......Would this make you feel confident in your download? – Kat Dec 3 '17 at 6:52
  • I didn't know about the Windows Digital Signature. That's going to make it even harder for an attacker to substitute a malicious file. I'll update my answer with the quick steps I use for verification. – sipwiz Dec 3 '17 at 8:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.