<blockquote>
  <p>Is it recommendable/indispensable?</p>
</blockquote>

<p>Yes, it is a <strong>MUST</strong> not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the <a href="https://bitcoin.org/en/download" rel="nofollow noreferrer">bitcoin.org</a> website.</p>

<ul>
<li>Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit</li>
<li>Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates</li>
<li>Attacker can launch a <a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack" rel="nofollow noreferrer">man-in-the-middle attack</a> on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website</li>
</ul>

<p>Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.</p>

<p>In fact, Bitcoin Core developers <a href="https://bitcoin.org/en/alert/2016-08-17-binary-safety" rel="nofollow noreferrer">issued a warning</a> during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.</p>

<p>It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the <a href="https://github.com/bitcoin-core/gitian.sigs" rel="nofollow noreferrer">gitian signature repository</a> to get other signatures and verify multiple signature data through multiple channels.</p>

<blockquote>
  <p>Can I still check the keys once it is up and running?</p>
</blockquote>

<p>You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the <code>/usr/bin/bitcoind</code>. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.</p>

<blockquote>
  <p>Will I have to reinstall and download the entire blockchain again?</p>
</blockquote>

<p>If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.</p>

CC BY-SA 4.0
2019-10-14T19:39:21.303Z
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound  connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
Saidjinn
CC BY-SA 4.0
2019-10-15T05:14:44.277Z
@Saidjinn for accepting incoming connections, you should set `listen=1` in the `bitcoin.conf` file or pass it as a parameter when starting `bitcoind`. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it [here](https://bitcoin.stackexchange.com/questions/88127/are-nodes-that-dont-accept-inbound-connections-necessarily-leechers)
Ugam Kamat
CC BY-SA 4.0
2019-10-14T10:56:53.467Z
2019-10-14T10:56:53.467Z
Ugam Kamat
<p>I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org. </p>

<p>I have recently been delving deeper and I realized that I never checked the keys. </p>

<p>Is it recommendable/indispensable? </p>

<p>Can I still check the keys once it is up and running? </p>

<p>Will I have to reinstall and download the entire blockchain again?</p>

CC BY-SA 4.0
2019-10-14T19:07:44.530Z
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
mimo
<bitcoin-core><verification>
Should I verify the Bitcoin Core release signing keys?
Saidjinn
# Should I verify the Bitcoin Core release signing keys?

(Asked by: username_0 on 2019-10-14)

I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.

I have recently been delving deeper and I realized that I never checked the keys.

Is it recommendable/indispensable?

Can I still check the keys once it is up and running?

Will I have to reinstall and download the entire blockchain again?

**Tags:** bitcoin-core, verification

> **Comments:**
> **username_1**: You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.  

---

## 1 answers

### Answer by username_2 on 2019-10-14. Score: 4 | Accepted answer

> Is it recommendable/indispensable?

Yes, it is a **MUST** not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the [bitcoin.org](https://bitcoin.org/en/download) website.

* Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
* Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
* Attacker can launch a [man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website

Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.

In fact, Bitcoin Core developers [issued a warning](https://bitcoin.org/en/alert/2016-08-17-binary-safety) during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.

It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the [gitian signature repository](https://github.com/bitcoin-core/gitian.sigs) to get other signatures and verify multiple signature data through multiple channels.

> Can I still check the keys once it is up and running?

You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the `/usr/bin/bitcoind`. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.

> Will I have to reinstall and download the entire blockchain again?

If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.

> **Comments:**
> **username_0**: Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound  connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.  
> **username_2**: @username_0 for accepting incoming connections, you should set `listen=1` in the `bitcoin.conf` file or pass it as a parameter when starting `bitcoind`. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it [here](https://bitcoin.stackexchange.com/questions/88127/are-nodes-that-dont-accept-inbound-connections-necessarily-leechers)  

---

