1 files changed, 104 insertions, 0 deletions
diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml
new file mode 100644
index 0000000..8e37210
--- /dev/null
+++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml
@@ -0,0 +1,104 @@
+@startuml
+left to right direction
+skinparam rectangle {
+  BackgroundColor #FFF6F6
+  BorderColor #550000
+}
+skinparam note {
+  BackgroundColor #FFFFCC
+}
+
+right header
+= Threat Model - Reproducible Builds according to SLSA Level 4
+using independent GnuPG signatures and keys
+as well as Reproducible Builds according to SLSA Level 4
+corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD
+=  %date("yyyy-MM-dd hh:mm")
+endheader
+
+right footer
+= Advantages:
+* Consistency between source code and binaries through Reproducible Builds
+* No single trust anchor -> at least 2 independent builders
+* Subsequent manipulation detectable through checksums in the Git Transparency Log
+* Insider attacks made more difficult through multiple signatures
+* Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps
+* Each box is a trust boarder
+endfooter
+
+
+
+caption
+= Threat Model - Reproducible Builds according to SLSA Level 4
+endcaption
+
+actor "Downloader\n(Verifier)" as User #Green
+actor "Internet\n(Insecure)" as Net
+actor "NTP Server 1" as NTP1
+actor "NTP Server 2 " as NTP2
+actor "Attacker\n(Insider / External)" as Attacker #Red
+'actor "Trusted Commiter 1" as Committer1 
+'actor "Trusted Commiter 2" as Committer2 
+
+actor "Keyserver 1" as Keyserver1 
+actor "Keyserver 2" as Keyserver2 
+
+
+rectangle "Maintainer" {
+  rectangle "Source Code\n(in Git)" as Source
+  rectangle "Git Release Tag\n(GnuPG-signed)" as Tag
+}
+
+rectangle "Independent build pipelines\n(at least 2)" {
+  rectangle "Pipe A" as B1
+  rectangle "Pipe B" as B2
+}
+
+rectangle "Download artefacts" {
+  rectangle "Artefact A\n(Checksum)" as A1
+  rectangle "Artefact B\n(Checksum)" as A2
+}
+
+rectangle "Git Transparency Log\n(tamper-hardened)" as Log
+rectangle "Distributed ledger with\n Merkle Tree records\n (Blockchain)" as Ledger
+
+rectangle "Operational environment\n(of the downloader)" {
+  rectangle "Known public signing keys\n(obtained from at least\n 2 independent trust paths)" as Keys
+  rectangle "Rebuild pipeline\n(Reproducible)" as Rebuild
+  rectangle "Verification policy\n (organisational measure\n from BSI TR)" as Policy
+}
+
+NTP1 --> Log : Time
+NTP2 --> Log : Time
+
+Keyserver1 --> Keys : retrieves
+Keyserver2 --> Keys : retrieves
+
+Source --> B1
+Source --> B2
+
+B1 --> A1
+B2 --> A2
+
+A1 --> Log : Checksum
+A2 --> Log : Checksum
+
+A1 --> Ledger : Checksum
+A2 --> Ledger : Checksum
+
+Tag --> Source
+
+Net --> User
+Attacker -[#Red]-> B1 : compromises
+Attacker -[#Red]-> Net : controls
+Attacker -[#Red]-> Tag : compromises private key
+'// Commiter1 --> Tag : generates valid signature 
+'// Commiter2 --> Tag : generates valid signature 
+
+
+User --> Rebuild
+User --> Log
+Keys --> Policy
+Rebuild --> Policy
+Policy --> User : ACCEPT / REJECT
+@enduml