From 8346f109d823a1656f0ef7410c2a4d6365051608 Mon Sep 17 00:00:00 2001 From: Stefan Schumacher Date: Tue, 5 May 2026 17:24:18 +0200 Subject: Pages Init --- .../GnuPG-WoT-Download/README.html | 573 +++++++++++++++++++++ 1 file changed, 573 insertions(+) create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html') diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html new file mode 100644 index 0000000..5bc2456 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html @@ -0,0 +1,573 @@ + + + + + + + + +PLantUML Diagrams for GnuPG Key Signing + + + + + +
+
+
+
+

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

+
+
+

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

+
+
+
+
+

DFD: Keysigning Simple

+
+
+
+100 GnuPG Keysigning DFD +
+
+
+
+
+

SEQ: Keysigning with ID check and WoT

+
+
+
+100 GnuPG Keysigning SEQ KSP WoT +
+
+
+
+
+

NetBSD RelEng Attack STRIDE

+
+
+

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

+
+
+

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

+
+
+

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

+
+
+
+300 NetBSD RelEng STRIDE +
+
+
+
+
+

Supply-chain Levels for Software Artifacts

+
+
+

A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines.

+
+
+
+200 ThreatModel SLSA1 DownloadSig +
+
+
+

Reproducible Builds SLSA L4

+
+

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors

+
+
+

The whole implementation

+
+
    +
  • +

    Trust Boundaries: Rectangles

    +
    • +
  • +

    Attack Vectors: Red Arrows

    +
    • +
+
+
+
+201 ThreatModel SLSA4 ReproducibleBuilds +
+
+
+
    +
  • +

    Trust Anchor: Green Anchor

    +
    • +
+
+
+
+202 ThreatModel SLSA4 ReproducibleBuilds TrustAnchor +
+
+
+
+
+

Motivation/Business Layer: Risk/Security Overlay

+
+
+203 SLSA4 ReproducibleBuilds L1 Motivation +
+
+
+
+
+
+ + + \ No newline at end of file -- cgit v1.2.3