From eb4668408ceac440972213053ab0d97f6fa7ae89 Mon Sep 17 00:00:00 2001
From: stefan <stefan@i3mint.local>
Date: Mon, 23 Feb 2026 18:53:35 +0100
Subject: SLSA models added

Signed-off-by: stefan <stefan@i3mint.local>
---
 .../200-ThreatModel-SLSA1-DownloadSig.puml         | 66 ++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml

(limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml')

diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml
new file mode 100644
index 0000000..4371bf5
--- /dev/null
+++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml
@@ -0,0 +1,66 @@
+@startuml
+left to right direction
+skinparam rectangle {
+  BackgroundColor #F9F9F9
+  BorderColor #333
+}
+
+
+right header
+= Threat Model - Integrity verification of download artifacts with key list!
+using independent GnuPG signatures and public keys
+as well as a key list with authorised signing keys
+=  %date("yyyy-MM-dd hh:hh") UTC
+endheader
+
+right footer
+* Maintainer publishes signed artifacts, public GnuPG keys and signed key list
+* The key list or its signature is the central trust anchor
+* Both are located in a central place!
+* If the key list and the information about signature authorisation of the key list are replaced, manipulated artifacts with valid signatures can be distributed
+* The security objective authenticity of the artifacts can therefore be violated
+endfooter
+
+
+
+
+actor "Downloader\n(Verifier)" as User #Green
+actor "Attacker\n(MITM / Mirror)" as Attacker #Red
+' actor "Keyserver" as Keyserver 
+' actor "Website with signed key list\nand information about signature authorisation of the key list"  as WWW #Orange
+
+
+
+rectangle "Maintainer" {
+  rectangle "Private key\n(on hardware token)" as PrivKey
+  rectangle "Release artifact\n(binary)" as Artifact
+  rectangle "Signature\n(.asc)" as Sig
+}
+
+rectangle "Website with signed key list\nand information about signature authorisation of the key list" as Channel #Orange
+
+rectangle "Verification environment\n(Server)" {
+  rectangle "Public key\nfrom keyserver\n(fingerprint verified)" as PubKey
+  rectangle "gpg --verify *.asc" as GPG
+}
+
+PrivKey --> Sig : signs
+Artifact --> Sig
+
+Sig --> Channel
+Artifact --> Channel
+
+Channel --> User
+' Attacker -[#Red]-> Channel : MITM attack
+Attacker -[#Red]-> Channel: replaces key list
+
+
+' Keyserver --> User: retrieves public keys
+Channel --> User: retrieves key list and verifies its signature
+User --> GPG
+PubKey --> GPG
+Artifact --> GPG
+Sig --> GPG
+
+GPG --> User : OK / FAIL
+@enduml
-- 
cgit v1.2.3