{"id":33247,"date":"2019-10-31T21:51:34","date_gmt":"2019-10-31T18:51:34","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi\/"},"modified":"2019-10-31T21:51:34","modified_gmt":"2019-10-31T18:51:34","slug":"reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-wordpress-5-2-s-podderzhkoj-proverki-obnovlenij-po-tsifrovoj-podpisi","title":{"rendered":"Release of WordPress 5.2 with support for digital signature update checking","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Introduced<\/a><\/noindex> release of the web content management system WordPress 5.2<\/a><\/noindex>. The release is notable for completing a six-year saga<\/a><\/noindex> of implementing capabilities<\/a><\/noindex> update and add-on verification through digital signatures. <\/p>\n

Until now, when installing updates in WordPress, the main security factor was trust in the WordPress infrastructure and servers (after downloading, a hash check was performed without source verification). In the event of server compromise, attackers could substitute the update and spread malicious code among WordPress sites using the automatic update system. Under the previously used trust delivery model, such substitution on the user side would go unnoticed. <\/p>\n

Considering that according to data<\/a><\/noindex> the w3techs project, the WordPress platform is used on 33.8% of websites on the internet, the incident would have had catastrophic implications. Moreover, the threat of infrastructure compromise was not hypothetical but quite real. For example, several years ago, one security researcher demonstrated<\/a><\/noindex> discovered a vulnerability that allowed an attacker to execute their code on the api.wordpress.org server. <\/p>\n

In the case of using digital signatures, gaining control over the update distribution server would not compromise user systems, as conducting an attack would additionally require obtaining a separately stored private key used for signing updates. <\/p>\n

The implementation of update source verification through digital signatures was hindered by the fact that support for the necessary cryptographic algorithms became available in PHP's standard distribution relatively recently. The required cryptographic algorithms were introduced thanks to the integration of the Libsodium<\/a><\/noindex> library into the core of PHP 7.2<\/a><\/noindex>. However, the minimum supported version of PHP declared in WordPress is the<\/a><\/noindex> version 5.2.4 (starting from WordPress 5.2 \u2014 5.6.20). Enabling support for digital signatures would significantly increase the requirements for the minimum supported version of PHP or require the addition of an external dependency, which the developers could not accept given the prevalence of PHP versions in hosting systems. <\/p>\n

The solution was development<\/a><\/noindex> and the inclusion in WordPress 5.2 of a compact version of Libsodium \u2014 Sodium Compat<\/a><\/noindex>, which implements a minimal set of algorithms in PHP for verifying digital signatures. The implementation leaves much to be desired in terms of performance but fully addresses compatibility issues and allows plugin developers to begin integrating modern cryptographic algorithms.<\/p>\n

The algorithm used for generating digital signatures is properties<\/a><\/noindex>, developed with the participation of Daniel J. Bernstein. A digital signature is formed for the SHA384 hash value computed from the contents of the archive being updated. Ed25519 offers a higher level of security than ECDSA and DSA, demonstrating very high verification and signature creation speeds. The resilience to attacks for Ed25519 is around 2^128 (on average, an attack on Ed25519 requires performing 2^140 bit operations), which corresponds to the resilience of algorithms like NIST P-256 and RSA with a key size of 3000 bits or a 128-bit block cipher. Ed25519 is also immune to hash collision issues, is not susceptible to cache-timing attacks, and is resistant to side-channel attacks. <\/p>\n

In the release of WordPress 5.2, digital signature verification currently only covers the core platform updates and does not by default block updates but merely informs the user of any issues. The decision was made not to enable blocking by default due to the need for complete verification and circumvention of potential issues<\/a><\/noindex>. In the future, verification via digital signatures is also planned to be added for the installation source verification of themes and plugins (manufacturers will be able to sign releases with their key).<\/p>\n

In addition to supporting digital signatures in WordPress 5.2, the following changes can be noted:<\/p>\n