From eb4668408ceac440972213053ab0d97f6fa7ae89 Mon Sep 17 00:00:00 2001 From: stefan Date: Mon, 23 Feb 2026 18:53:35 +0100 Subject: SLSA models added Signed-off-by: stefan --- .../100-GnuPG-Keysigning-DFD.png | Bin 57308 -> 57333 bytes .../100-GnuPG-Keysigning-DFD.svg | 2 +- .../100-GnuPG-Keysigning-SEQ-KSP-WoT.png | Bin 121537 -> 121553 bytes .../100-GnuPG-Keysigning-SEQ-KSP-WoT.svg | 2 +- .../101-Multiple-GnuPG-signatures-Trust.png | Bin 0 -> 27016 bytes .../101-Multiple-GnuPG-signatures-Trust.puml | 45 +++++++++ .../101-Multiple-GnuPG-signatures-Trust.svg | 1 + .../200-ThreatModel-SLSA1-DownloadSig.png | Bin 0 -> 38288 bytes .../200-ThreatModel-SLSA1-DownloadSig.puml | 66 +++++++++++++ .../200-ThreatModel-SLSA1-DownloadSig.svg | 1 + .../201-ThreatModel-SLSA4-ReproducibleBuilds.png | Bin 0 -> 63781 bytes .../201-ThreatModel-SLSA4-ReproducibleBuilds.puml | 104 +++++++++++++++++++++ .../201-ThreatModel-SLSA4-ReproducibleBuilds.svg | 1 + .../300-NetBSD-RelEng-STRIDE.png | Bin 78609 -> 78625 bytes .../300-NetBSD-RelEng-STRIDE.svg | 2 +- 15 files changed, 221 insertions(+), 3 deletions(-) create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.puml create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.svg create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.svg create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml create mode 100644 PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.svg (limited to 'PlantUML-ModelingTrust/GnuPG-WoT-Download') diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png index d37ee4b..fb17d9f 100644 Binary files a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.svg index d336bf4..9869c2b 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.svg +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-DFD.svg @@ -1 +1 @@ -Daten Flow Diagram - GnuPG Keysigning between Alice and BobDFD: Alice and Bob KeysigningCompiled: 2026-02-22 15:43 +0100Daten Flow Diagram - GnuPG Keysigning between Alice and BobAliceBobKeyserverAlice KeyringBob KeyringPubKey AlicePubKey Bobsigned PubKey of Alice -> Bobsigned PubKey of Bob -> Alice1. export own PubKey1. export own PubKey2. mail own PubKey to Bob2. mail own PubKey to Alice3. sign PubKey of Alice3. sign PubKey of Bob4. mail signed PubKey of Alice to the mail address in the key4. mail signed PubKey of Bob to the mail address in the key5. import signed PubKey5. signed PubKey6. send new signature to Keyserver6. send new signature to Keyserver \ No newline at end of file +Daten Flow Diagram - GnuPG Keysigning between Alice and BobDFD: Alice and Bob KeysigningCompiled: 2026-02-23 18:52 +0100Daten Flow Diagram - GnuPG Keysigning between Alice and BobAliceBobKeyserverAlice KeyringBob KeyringPubKey AlicePubKey Bobsigned PubKey of Alice -> Bobsigned PubKey of Bob -> Alice1. export own PubKey1. export own PubKey2. mail own PubKey to Bob2. mail own PubKey to Alice3. sign PubKey of Alice3. sign PubKey of Bob4. mail signed PubKey of Alice to the mail address in the key4. mail signed PubKey of Bob to the mail address in the key5. import signed PubKey5. signed PubKey6. send new signature to Keyserver6. send new signature to Keyserver \ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png index 9676b06..66befaa 100644 Binary files a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.svg index fbc52b8..e363b69 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.svg +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/100-GnuPG-Keysigning-SEQ-KSP-WoT.svg @@ -1 +1 @@ -Sequence Diagram - Mutual Key Signing with Owner Trust (<font:monospace>tsign</font>)Sequence Diagram - Mutual Key Signing with Owner Trust (tsign)AliceBobAlice GnuPGBob GnuPGAlice KeyringBob KeyringAlice Owner TrustBob Owner TrustAlice PassportBob PassportAliceAliceBobBobAlice GnuPGAlice GnuPGBob GnuPGBob GnuPGAlice KeyringAlice KeyringBob KeyringBob KeyringAlice Owner TrustAlice Owner TrustBob Owner TrustBob Owner TrustAlice PassportAlice PassportBob PassportBob PassportKey Signing PartyID Verification via PassportVerify Bobs Passportverify ID and Key-FingerprintVerify Alice Passportverify ID and Key-Fingerprint:wKeyExchangeKey ExchangeExport PubKeyRead PubKeyof AliceSend PubKeyof AliceExport PubKeyRead PubKeyof BobSend PubKeyof BobSigningSign Alice key(identity verified)Store signature on Alice keyMail signed Alice keySign Bob key(identity verified)Store signature on Bob keyMail signed Bob keyImportImport signed Alice keyUpdate keyringImport signed Bob keyUpdate keyringSet Owner TrustSet owner trust for BobStore trust levelSet owner trust for AliceStore trust levelTrust calculation voa Web of TrustWeb of Trust CalculationCheck validity of Bob keyRead signaturesRead owner trust valuesValidity status(unknown/marginal/full)Check validity of Alice keyRead signaturesRead owner trust valuesValidity status(unknown/marginal/full)Sequence of Key Signing with n==2Compiled: 2026-02-22 15:43 +0100Keysigning between Alice and Bob.gpg --recv-keys 0x11F4C41EB3FBAE33.gpg --edit-key 0x11F4C41EB3FBAE33.tsign.gpgarmorexport-options export-minimal --export 0xB3FBAE33 > 0xB3FBAE33.asc \ No newline at end of file +Sequence Diagram - Mutual Key Signing with Owner Trust (<font:monospace>tsign</font>)Sequence Diagram - Mutual Key Signing with Owner Trust (tsign)AliceBobAlice GnuPGBob GnuPGAlice KeyringBob KeyringAlice Owner TrustBob Owner TrustAlice PassportBob PassportAliceAliceBobBobAlice GnuPGAlice GnuPGBob GnuPGBob GnuPGAlice KeyringAlice KeyringBob KeyringBob KeyringAlice Owner TrustAlice Owner TrustBob Owner TrustBob Owner TrustAlice PassportAlice PassportBob PassportBob PassportKey Signing PartyID Verification via PassportVerify Bobs Passportverify ID and Key-FingerprintVerify Alice Passportverify ID and Key-Fingerprint:wKeyExchangeKey ExchangeExport PubKeyRead PubKeyof AliceSend PubKeyof AliceExport PubKeyRead PubKeyof BobSend PubKeyof BobSigningSign Alice key(identity verified)Store signature on Alice keyMail signed Alice keySign Bob key(identity verified)Store signature on Bob keyMail signed Bob keyImportImport signed Alice keyUpdate keyringImport signed Bob keyUpdate keyringSet Owner TrustSet owner trust for BobStore trust levelSet owner trust for AliceStore trust levelTrust calculation voa Web of TrustWeb of Trust CalculationCheck validity of Bob keyRead signaturesRead owner trust valuesValidity status(unknown/marginal/full)Check validity of Alice keyRead signaturesRead owner trust valuesValidity status(unknown/marginal/full)Sequence of Key Signing with n==2Compiled: 2026-02-23 18:52 +0100Keysigning between Alice and Bob.gpg --recv-keys 0x11F4C41EB3FBAE33.gpg --edit-key 0x11F4C41EB3FBAE33.tsign.gpgarmorexport-options export-minimal --export 0xB3FBAE33 > 0xB3FBAE33.asc \ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png new file mode 100644 index 0000000..c5a7dac Binary files /dev/null and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.puml new file mode 100644 index 0000000..737d8a6 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.puml @@ -0,0 +1,45 @@ +@startuml + ' keine farben!! +' !theme mimeograph + +skinparam shadowing false + +Title DFD: Multiple GnuPG Signatures for the NetBSD ISO image + +header += Combining Trust from the Web of Trust +Timestamp: %date("yyyy-MM-dd kk:mm Z") +endheader + + + +entity Alice +entity Bob +entity Charly + +database "NetBSD ISO Repository" as ISORepo +database "Public Signature Store" as SigStore + +circle "Download ISO" as P1 +circle "Compute SHA256 Hash" as P2 +circle "Sign ISO Hash\n(Private Key)" as P3 +circle "Publish Signature" as P4 + +Alice --> P1 +P1 --> ISORepo +ISORepo --> P2 +P2 --> P3 +P3 --> P4 +P4 --> SigStore + +Bob --> P1 +Bob --> P2 +Bob --> P3 +Bob --> P4 + +Charly --> P1 +Charly --> P2 +Charly --> P3 +Charly --> P4 + +@enduml diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.svg new file mode 100644 index 0000000..3571e5c --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/101-Multiple-GnuPG-signatures-Trust.svg @@ -0,0 +1 @@ +DFD: Multiple GnuPG Signatures for the NetBSD ISO imageCombining Trust from the Web of TrustTimestamp: 2026-02-23 18:52 +0100DFD: Multiple GnuPG Signatures for the NetBSD ISO imageAliceBobCharlyNetBSD ISO RepositoryPublic Signature StoreDownload ISOCompute SHA256 HashSign ISO Hash(Private Key)Publish Signature \ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png new file mode 100644 index 0000000..daac44f Binary files /dev/null and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml new file mode 100644 index 0000000..4371bf5 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.puml @@ -0,0 +1,66 @@ +@startuml +left to right direction +skinparam rectangle { + BackgroundColor #F9F9F9 + BorderColor #333 +} + + +right header += Threat Model - Integrity verification of download artifacts with key list! +using independent GnuPG signatures and public keys +as well as a key list with authorised signing keys += %date("yyyy-MM-dd hh:hh") UTC +endheader + +right footer +* Maintainer publishes signed artifacts, public GnuPG keys and signed key list +* The key list or its signature is the central trust anchor +* Both are located in a central place! +* If the key list and the information about signature authorisation of the key list are replaced, manipulated artifacts with valid signatures can be distributed +* The security objective authenticity of the artifacts can therefore be violated +endfooter + + + + +actor "Downloader\n(Verifier)" as User #Green +actor "Attacker\n(MITM / Mirror)" as Attacker #Red +' actor "Keyserver" as Keyserver +' actor "Website with signed key list\nand information about signature authorisation of the key list" as WWW #Orange + + + +rectangle "Maintainer" { + rectangle "Private key\n(on hardware token)" as PrivKey + rectangle "Release artifact\n(binary)" as Artifact + rectangle "Signature\n(.asc)" as Sig +} + +rectangle "Website with signed key list\nand information about signature authorisation of the key list" as Channel #Orange + +rectangle "Verification environment\n(Server)" { + rectangle "Public key\nfrom keyserver\n(fingerprint verified)" as PubKey + rectangle "gpg --verify *.asc" as GPG +} + +PrivKey --> Sig : signs +Artifact --> Sig + +Sig --> Channel +Artifact --> Channel + +Channel --> User +' Attacker -[#Red]-> Channel : MITM attack +Attacker -[#Red]-> Channel: replaces key list + + +' Keyserver --> User: retrieves public keys +Channel --> User: retrieves key list and verifies its signature +User --> GPG +PubKey --> GPG +Artifact --> GPG +Sig --> GPG + +GPG --> User : OK / FAIL +@enduml diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.svg new file mode 100644 index 0000000..3c5b37e --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/200-ThreatModel-SLSA1-DownloadSig.svg @@ -0,0 +1 @@ +Threat Model - Integrity verification of download artifacts with key list!using independent GnuPG signatures and public keysas well as a key list with authorised signing keys2026-02-23 08:08 UTCMaintainerVerification environment(Server)Private key(on hardware token)Release artifact(binary)Signature(.asc)Public keyfrom keyserver(fingerprint verified)gpg --verify *.ascDownloader(Verifier)Attacker(MITM / Mirror)Website with signed key listand information about signature authorisation of the key listsignsretrieves key list and verifies its signaturereplaces key listOK / FAILMaintainer publishes signed artifacts, public GnuPG keys and signed key listThe key list or its signature is the central trust anchorBoth are located in a central place!If the key list and the information about signature authorisation of the key list are replaced, manipulated artifacts with valid signatures can be distributedThe security objective authenticity of the artifacts can therefore be violated \ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png new file mode 100644 index 0000000..fb7b8c4 Binary files /dev/null and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml new file mode 100644 index 0000000..8e37210 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.puml @@ -0,0 +1,104 @@ +@startuml +left to right direction +skinparam rectangle { + BackgroundColor #FFF6F6 + BorderColor #550000 +} +skinparam note { + BackgroundColor #FFFFCC +} + +right header += Threat Model - Reproducible Builds according to SLSA Level 4 +using independent GnuPG signatures and keys +as well as Reproducible Builds according to SLSA Level 4 +corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD += %date("yyyy-MM-dd hh:mm") +endheader + +right footer += Advantages: +* Consistency between source code and binaries through Reproducible Builds +* No single trust anchor -> at least 2 independent builders +* Subsequent manipulation detectable through checksums in the Git Transparency Log +* Insider attacks made more difficult through multiple signatures +* Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps +* Each box is a trust boarder +endfooter + + + +caption += Threat Model - Reproducible Builds according to SLSA Level 4 +endcaption + +actor "Downloader\n(Verifier)" as User #Green +actor "Internet\n(Insecure)" as Net +actor "NTP Server 1" as NTP1 +actor "NTP Server 2 " as NTP2 +actor "Attacker\n(Insider / External)" as Attacker #Red +'actor "Trusted Commiter 1" as Committer1 +'actor "Trusted Commiter 2" as Committer2 + +actor "Keyserver 1" as Keyserver1 +actor "Keyserver 2" as Keyserver2 + + +rectangle "Maintainer" { + rectangle "Source Code\n(in Git)" as Source + rectangle "Git Release Tag\n(GnuPG-signed)" as Tag +} + +rectangle "Independent build pipelines\n(at least 2)" { + rectangle "Pipe A" as B1 + rectangle "Pipe B" as B2 +} + +rectangle "Download artefacts" { + rectangle "Artefact A\n(Checksum)" as A1 + rectangle "Artefact B\n(Checksum)" as A2 +} + +rectangle "Git Transparency Log\n(tamper-hardened)" as Log +rectangle "Distributed ledger with\n Merkle Tree records\n (Blockchain)" as Ledger + +rectangle "Operational environment\n(of the downloader)" { + rectangle "Known public signing keys\n(obtained from at least\n 2 independent trust paths)" as Keys + rectangle "Rebuild pipeline\n(Reproducible)" as Rebuild + rectangle "Verification policy\n (organisational measure\n from BSI TR)" as Policy +} + +NTP1 --> Log : Time +NTP2 --> Log : Time + +Keyserver1 --> Keys : retrieves +Keyserver2 --> Keys : retrieves + +Source --> B1 +Source --> B2 + +B1 --> A1 +B2 --> A2 + +A1 --> Log : Checksum +A2 --> Log : Checksum + +A1 --> Ledger : Checksum +A2 --> Ledger : Checksum + +Tag --> Source + +Net --> User +Attacker -[#Red]-> B1 : compromises +Attacker -[#Red]-> Net : controls +Attacker -[#Red]-> Tag : compromises private key +'// Commiter1 --> Tag : generates valid signature +'// Commiter2 --> Tag : generates valid signature + + +User --> Rebuild +User --> Log +Keys --> Policy +Rebuild --> Policy +Policy --> User : ACCEPT / REJECT +@enduml diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.svg new file mode 100644 index 0000000..231e779 --- /dev/null +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/201-ThreatModel-SLSA4-ReproducibleBuilds.svg @@ -0,0 +1 @@ +Threat Model - Reproducible Builds according to SLSA Level 4using independent GnuPG signatures and keysas well as Reproducible Builds according to SLSA Level 4corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD2026-02-23 06:52MaintainerIndependent build pipelines(at least 2)Download artefactsOperational environment(of the downloader)Source Code(in Git)Git Release Tag(GnuPG-signed)Pipe APipe BArtefact A(Checksum)Artefact B(Checksum)Known public signing keys(obtained from at least2 independent trust paths)Rebuild pipeline(Reproducible)Verification policy(organisational measurefrom BSI TR)Downloader(Verifier)Internet(Insecure)NTP Server 1NTP Server 2Attacker(Insider / External)Keyserver 1Keyserver 2Git Transparency Log(tamper-hardened)Distributed ledger withMerkle Tree records(Blockchain)TimeTimeretrievesretrievesChecksumChecksumChecksumChecksumcompromisescontrolscompromises private keyACCEPT / REJECTThreat Model - Reproducible Builds according to SLSA Level 4Advantages:Consistency between source code and binaries through Reproducible BuildsNo single trust anchor -> at least 2 independent buildersSubsequent manipulation detectable through checksums in the Git Transparency LogInsider attacks made more difficult through multiple signaturesKey misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestampsEach box is a trust boarder \ No newline at end of file diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png index dae1c1b..1bf7971 100644 Binary files a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png and b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.png differ diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.svg b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.svg index 6f3cbac..16b0263 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.svg +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/300-NetBSD-RelEng-STRIDE.svg @@ -1 +1 @@ -Attack Flow and Trust Boundaries: manipulated ISO image AND manipulated checksums/signatures (SLSA1)Attack Flows and Trust BoundariesTimestamp: 2026-02-22 15:47 +0100Attack Flow and Trust Boundaries: manipulated ISO image AND manipulated checksums/signatures (SLSA1)InternetDMZInternal NetworkBlack HatPublic Web Server:T, I, DoS, EoPCVS RelEngT, R, EoPRelease RepoHVTS, T, R, I, DoS, EoPSecurity Officer(DF1) Publish ISO + Checksums(DF2) Sign Checksums (GnuPG)(DF3) Deploy Artifacts(AT2) Pivot to RepoEoP(DF4) Distribute ISO + Checksums + Signature(AT1) Exploit Webserver VulnEoP(AT3) Replace ISO&& Checksum&& SignatureTamperSTRIDEAbbreviationSSpoofingTTamperingRRepudiationIInformation DisclosureDoSDenial of ServiceEoPElevation of Privilege Relationship ColourColourAttack PhaseRedInitial ExploitDeep PurpleLateral MovementOrangeIntegrity ViolationGreenLegitimate Signing LightGray box: Trust BoundaryNotes on Relation: STRIDE categoryDF: Data FlowAT: Attack Path \ No newline at end of file +Attack Flow and Trust Boundaries: manipulated ISO image AND manipulated checksums/signatures (SLSA1)Attack Flows and Trust BoundariesTimestamp: 2026-02-23 18:52 +0100Attack Flow and Trust Boundaries: manipulated ISO image AND manipulated checksums/signatures (SLSA1)InternetDMZInternal NetworkBlack HatPublic Web Server:T, I, DoS, EoPCVS RelEngT, R, EoPRelease RepoHVTS, T, R, I, DoS, EoPSecurity Officer(DF1) Publish ISO + Checksums(DF2) Sign Checksums (GnuPG)(DF3) Deploy Artifacts(AT2) Pivot to RepoEoP(DF4) Distribute ISO + Checksums + Signature(AT1) Exploit Webserver VulnEoP(AT3) Replace ISO&& Checksum&& SignatureTamperSTRIDEAbbreviationSSpoofingTTamperingRRepudiationIInformation DisclosureDoSDenial of ServiceEoPElevation of Privilege Relationship ColourColourAttack PhaseRedInitial ExploitDeep PurpleLateral MovementOrangeIntegrity ViolationGreenLegitimate Signing LightGray box: Trust BoundaryNotes on Relation: STRIDE categoryDF: Data FlowAT: Attack Path \ No newline at end of file -- cgit v1.2.3