PLantUML Diagrams for GnuPG Key Signing

From 8346f109d823a1656f0ef7410c2a4d6365051608 Mon Sep 17 00:00:00 2001 From: Stefan Schumacher Date: Tue, 5 May 2026 17:24:18 +0200 Subject: Pages Init --- .../GnuPG-WoT-Download/README.html | 573 +++++++++++++++++++++ 1 file changed, 573 insertions(+) create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html') diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html new file mode 100644 index 0000000..5bc2456 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html @@ -0,0 +1,573 @@ + + + + + + + + +PLantUML Diagrams for GnuPG Key Signing + + + + + +

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

DFD: Keysigning Simple

SEQ: Keysigning with ID check and WoT

NetBSD RelEng Attack STRIDE

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

Supply-chain Levels for Software Artifacts

A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines.

Reproducible Builds SLSA L4

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors

The whole implementation

+
Trust Boundaries: Rectangles
+
+
Attack Vectors: Red Arrows
+

201 ThreatModel SLSA4 ReproducibleBuilds

+
Trust Anchor: Green Anchor
+

202 ThreatModel SLSA4 ReproducibleBuilds TrustAnchor

Motivation/Business Layer: Risk/Security Overlay

203 SLSA4 ReproducibleBuilds L1 Motivation

+ + + \ No newline at end of file -- cgit v1.2.3 From dc79114e67cf4343d21152c52af1b936b581755e Mon Sep 17 00:00:00 2001 From: Stefan Schumacher Date: Tue, 5 May 2026 17:53:09 +0200 Subject: Pages Version --- .../GnuPG-WoT-Download/README.adoc | 41 +- .../GnuPG-WoT-Download/README.html | 72 ++- .../GnuPG-WoT-Download/README.pdf | Bin 500848 -> 513735 bytes PlantUML-ModelingTrust/README.html | 615 +++++++++++++++++++++ PlantUML-ModelingTrust/README.pdf | Bin 162571 -> 189302 bytes README.adoc | 29 +- README.html | 234 +++++++- README.pdf | Bin 0 -> 518556 bytes index.html | 234 +++++++- 9 files changed, 1199 insertions(+), 26 deletions(-) create mode 100644 PlantUML-ModelingTrust/README.html create mode 100644 README.pdf (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html') diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc index 7fa6b8b..fb7b965 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc @@ -1,8 +1,12 @@ -= PLantUML Diagrams for GnuPG Key Signing += PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4) 0.0.2 :pdf-page-size: A3 :pdf-page-layout: landscape + + +// tag::inhalt[] + I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling. So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff. @@ -32,7 +36,9 @@ image::300-NetBSD-RelEng-STRIDE.png[] == Supply-chain Levels for Software Artifacts -A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines. +=== SLSA L1 + +A simple threat model for SLSA Level 1: image::200-ThreatModel-SLSA1-DownloadSig.png[] @@ -40,7 +46,33 @@ image::200-ThreatModel-SLSA1-DownloadSig.png[] === Reproducible Builds SLSA L4 -Modeling Trust, Trust Anchors and Boundaries and Attack Vectors +Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4: + +The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser! + + +. general goals +.. Build process produces identical artefacts (bit-for-bit) from the same source and inputs +.. independent parties can rebuild and verify outputs match the original -> verify freedom from insider threat! +.. require a deterministic build environments +.. all build steps, dependencies, and tooling are tightly controlled and audited +. security goals: +.. detect tampering in build pipelines or artefacts +.. prevents hidden backdoors introduced during compilation or packaging by a malicious insider +.. ensure integrity of supply chain, dependencies and build tools +.. enables independent verification without trusting the original builder +.. drastrically reduce insider and supply chain attack surface +. Zero Trust: +.. never trust, always verify! +.. verifiable evidence (rebuild && compare) +.. eliminates implicit trust in build pipeline +.. build system considered untrustworthy +.. combine with signed artefacts and attestation frameworks for full supply chain integrity + + + + + ==== The whole implementation @@ -58,3 +90,6 @@ image::202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png[] === Motivation/Business Layer: Risk/Security Overlay image::203-SLSA4-ReproducibleBuilds-L1-Motivation.png[] + + +// end::inhalt[] diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html index 5bc2456..712e918 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html @@ -6,7 +6,7 @@ -PLantUML Diagrams for GnuPG Key Signing +PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4) + + + +

Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

+
»Ontological Analysis and Redesign of Risk Modeling in ArchiMate«
+
+
- +
  by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo.
  +
  +
  - +
    https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate
    +
  +
  +
+
+
+
»Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate«
+
+
- +
  by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello
  +
  +
  - +
    https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate
    +
  +
  +
+
+

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

Applied Examples: GnuPG Key Signing

The sub directory GnuPG-WoT-Download contains applied examples of the trust modeling. It is work in progress, but already contains some diagrams.

My goal is to model a reproducible builds distribution process with a zero trust architecture. And threat model it in PASTA as well as STRIDE.

Archimate Diagrams

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Example from Paper		Applied to the NetBSD download
+ + + +		+ + + +
+ + + +		+ + + +
+ + + +		+ + + +
+ + + +		+ + + +
		+ + + +
		+ + + +

Example from Paper

Applied to the NetBSD download

+ + + \ No newline at end of file diff --git a/PlantUML-ModelingTrust/README.pdf b/PlantUML-ModelingTrust/README.pdf index dc64d84..6a87708 100644 Binary files a/PlantUML-ModelingTrust/README.pdf and b/PlantUML-ModelingTrust/README.pdf differ diff --git a/README.adoc b/README.adoc index 7412102..e4ef49e 100644 --- a/README.adoc +++ b/README.adoc @@ -1,8 +1,27 @@ = Security Architecture Notes and Patterns +Stefan Schumacher +v0.0.1, 2026/01/03, Entwurf +:toc: left +:toclevels: 2 +:sectnums: all +:imagesdir: PlantUML-ModelingTrust/GnuPG-WoT-Download/ -. `GetPlantUML-CheatSheets.sh` +This is the pages version of Stefan Schumacher's Codeberg Repository at https://codeberg.org/0xKaishakunin/Architecture + +It contains several architecural patterns and exercises with PlantUML with regards to modeling trust and zero trust architecture patterns + + +== From GnuPG Keysigning Party to Reproducile Builds according to SLSA4 + +include::PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc[tags=inhalt] + + + +== Links + +. link:GetPlantUML-CheatSheets.sh[GetPlantUML-CheatSheets.sh] .. downloads some useful ArchiMate cheat sheets/overviews/examples via `wget` -. `PlantUML-ModelingTrust` -.. Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate -. `PlantUML-ModelingTrust/GnuPG-WoT-Download/` -.. A GnuPG Key Signing Party and Download Signatures (SLSA1) modeled in Archimate +. link:PlantUML-ModelingTrust/README.html[PlantUML-ModelingTrust] +.. Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate, some TextBook patterns +. link:PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html[PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html] +.. A GnuPG Key Signing Party and Download Signatures (SLSA1) as well as Reproducible Builds SLSA4 modeled in Archimate diff --git a/README.html b/README.html index 5bf5ec8..166f8de 100644 --- a/README.html +++ b/README.html @@ -5,6 +5,7 @@ + Security Architecture Notes and Patterns - +

This is the pages version of Stefan Schumacher’s Codeberg Repository at https://codeberg.org/0xKaishakunin/Architecture

It contains several architecural patterns and exercises with PlantUML with regards to modeling trust and zero trust architecture patterns

1. From GnuPG Keysigning Party to Reproducile Builds according to SLSA4

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

2. DFD: Keysigning Simple

3. SEQ: Keysigning with ID check and WoT

4. NetBSD RelEng Attack STRIDE

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

5. Supply-chain Levels for Software Artifacts

5.1. SLSA L1

A simple threat model for SLSA Level 1:

5.2. Reproducible Builds SLSA L4

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:

The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!

-
GetPlantUML-CheatSheets.sh
+
general goals
+
+
1. +
  Build process produces identical artefacts (bit-for-bit) from the same source and inputs
  +
2. +
  independent parties can rebuild and verify outputs match the original → verify freedom from insider threat!
  +
3. +
  require a deterministic build environments
  +
4. +
  all build steps, dependencies, and tooling are tightly controlled and audited
  +
+
+
+
security goals:
+
+
1. +
  detect tampering in build pipelines or artefacts
  +
2. +
  prevents hidden backdoors introduced during compilation or packaging by a malicious insider
  +
3. +
  ensure integrity of supply chain, dependencies and build tools
  +
4. +
  enables independent verification without trusting the original builder
  +
5. +
  drastrically reduce insider and supply chain attack surface
  +
+
+
+
Zero Trust:
+
+
1. +
  never trust, always verify!
  +
2. +
  verifiable evidence (rebuild && compare)
  +
3. +
  eliminates implicit trust in build pipeline
  +
4. +
  build system considered untrustworthy
  +
5. +
  combine with signed artefacts and attestation frameworks for full supply chain integrity
  +
+
+

5.2.1. The whole implementation

+
Trust Boundaries: Rectangles
+
+
Attack Vectors: Red Arrows
+

+
Trust Anchor: Green Anchor
+

5.3. Motivation/Business Layer: Risk/Security Overlay

6. Links

+
GetPlantUML-CheatSheets.sh
1. @@ -452,21 +669,21 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
-
PlantUML-ModelingTrust
+
PlantUML-ModelingTrust
1. -
  Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate
  +
  Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate, some TextBook patterns
-
PlantUML-ModelingTrust/GnuPG-WoT-Download/
+
PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html
1. -
  A GnuPG Key Signing Party and Download Signatures (SLSA1) modeled in Archimate
  +
  A GnuPG Key Signing Party and Download Signatures (SLSA1) as well as Reproducible Builds SLSA4 modeled in Archimate
@@ -474,9 +691,12 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b

diff --git a/README.pdf b/README.pdf new file mode 100644 index 0000000..3c3c90a Binary files /dev/null and b/README.pdf differ diff --git a/index.html b/index.html index 5bf5ec8..166f8de 100644 --- a/index.html +++ b/index.html @@ -5,6 +5,7 @@ + Security Architecture Notes and Patterns - +

This is the pages version of Stefan Schumacher’s Codeberg Repository at https://codeberg.org/0xKaishakunin/Architecture

It contains several architecural patterns and exercises with PlantUML with regards to modeling trust and zero trust architecture patterns

1. From GnuPG Keysigning Party to Reproducile Builds according to SLSA4

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

2. DFD: Keysigning Simple

3. SEQ: Keysigning with ID check and WoT

4. NetBSD RelEng Attack STRIDE

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

5. Supply-chain Levels for Software Artifacts

5.1. SLSA L1

A simple threat model for SLSA Level 1:

5.2. Reproducible Builds SLSA L4

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:

The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!

-
GetPlantUML-CheatSheets.sh
+
general goals
+
+
1. +
  Build process produces identical artefacts (bit-for-bit) from the same source and inputs
  +
2. +
  independent parties can rebuild and verify outputs match the original → verify freedom from insider threat!
  +
3. +
  require a deterministic build environments
  +
4. +
  all build steps, dependencies, and tooling are tightly controlled and audited
  +
+
+
+
security goals:
+
+
1. +
  detect tampering in build pipelines or artefacts
  +
2. +
  prevents hidden backdoors introduced during compilation or packaging by a malicious insider
  +
3. +
  ensure integrity of supply chain, dependencies and build tools
  +
4. +
  enables independent verification without trusting the original builder
  +
5. +
  drastrically reduce insider and supply chain attack surface
  +
+
+
+
Zero Trust:
+
+
1. +
  never trust, always verify!
  +
2. +
  verifiable evidence (rebuild && compare)
  +
3. +
  eliminates implicit trust in build pipeline
  +
4. +
  build system considered untrustworthy
  +
5. +
  combine with signed artefacts and attestation frameworks for full supply chain integrity
  +
+
+

5.2.1. The whole implementation

+
Trust Boundaries: Rectangles
+
+
Attack Vectors: Red Arrows
+

+
Trust Anchor: Green Anchor
+

5.3. Motivation/Business Layer: Risk/Security Overlay

6. Links

+
GetPlantUML-CheatSheets.sh
1. @@ -452,21 +669,21 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b
-
PlantUML-ModelingTrust
+
PlantUML-ModelingTrust
1. -
  Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate
  +
  Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate, some TextBook patterns
-
PlantUML-ModelingTrust/GnuPG-WoT-Download/
+
PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html
1. -
  A GnuPG Key Signing Party and Download Signatures (SLSA1) modeled in Archimate
  +
  A GnuPG Key Signing Party and Download Signatures (SLSA1) as well as Reproducible Builds SLSA4 modeled in Archimate
@@ -474,9 +691,12 @@ body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-b

-- cgit v1.2.3