diff options
Diffstat (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc')
| -rw-r--r-- | PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc | 41 |
1 files changed, 38 insertions, 3 deletions
diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc index 7fa6b8b..fb7b965 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc @@ -1,8 +1,12 @@ -= PLantUML Diagrams for GnuPG Key Signing += PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4) 0.0.2 :pdf-page-size: A3 :pdf-page-layout: landscape + + +// tag::inhalt[] + I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling. So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff. @@ -32,7 +36,9 @@ image::300-NetBSD-RelEng-STRIDE.png[] == Supply-chain Levels for Software Artifacts -A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines. +=== SLSA L1 + +A simple threat model for SLSA Level 1: image::200-ThreatModel-SLSA1-DownloadSig.png[] @@ -40,7 +46,33 @@ image::200-ThreatModel-SLSA1-DownloadSig.png[] === Reproducible Builds SLSA L4 -Modeling Trust, Trust Anchors and Boundaries and Attack Vectors +Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4: + +The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser! + + +. general goals +.. Build process produces identical artefacts (bit-for-bit) from the same source and inputs +.. independent parties can rebuild and verify outputs match the original -> verify freedom from insider threat! +.. require a deterministic build environments +.. all build steps, dependencies, and tooling are tightly controlled and audited +. security goals: +.. detect tampering in build pipelines or artefacts +.. prevents hidden backdoors introduced during compilation or packaging by a malicious insider +.. ensure integrity of supply chain, dependencies and build tools +.. enables independent verification without trusting the original builder +.. drastrically reduce insider and supply chain attack surface +. Zero Trust: +.. never trust, always verify! +.. verifiable evidence (rebuild && compare) +.. eliminates implicit trust in build pipeline +.. build system considered untrustworthy +.. combine with signed artefacts and attestation frameworks for full supply chain integrity + + + + + ==== The whole implementation @@ -58,3 +90,6 @@ image::202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png[] === Motivation/Business Layer: Risk/Security Overlay image::203-SLSA4-ReproducibleBuilds-L1-Motivation.png[] + + +// end::inhalt[] |