PLantUML Diagrams for GnuPG Key Signing

From dc79114e67cf4343d21152c52af1b936b581755e Mon Sep 17 00:00:00 2001 From: Stefan Schumacher Date: Tue, 5 May 2026 17:53:09 +0200 Subject: Pages Version --- .../GnuPG-WoT-Download/README.adoc | 41 +- .../GnuPG-WoT-Download/README.html | 72 ++- .../GnuPG-WoT-Download/README.pdf | Bin 500848 -> 513735 bytes PlantUML-ModelingTrust/README.html | 615 +++++++++++++++++++++ PlantUML-ModelingTrust/README.pdf | Bin 162571 -> 189302 bytes 5 files changed, 721 insertions(+), 7 deletions(-) create mode 100644 PlantUML-ModelingTrust/README.html (limited to 'PlantUML-ModelingTrust') diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc index 7fa6b8b..fb7b965 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.adoc @@ -1,8 +1,12 @@ -= PLantUML Diagrams for GnuPG Key Signing += PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4) 0.0.2 :pdf-page-size: A3 :pdf-page-layout: landscape + + +// tag::inhalt[] + I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling. So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff. @@ -32,7 +36,9 @@ image::300-NetBSD-RelEng-STRIDE.png[] == Supply-chain Levels for Software Artifacts -A simple threat model for SLSA Level 1 and Leve 4 build and distribution pipelines. +=== SLSA L1 + +A simple threat model for SLSA Level 1: image::200-ThreatModel-SLSA1-DownloadSig.png[] @@ -40,7 +46,33 @@ image::200-ThreatModel-SLSA1-DownloadSig.png[] === Reproducible Builds SLSA L4 -Modeling Trust, Trust Anchors and Boundaries and Attack Vectors +Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4: + +The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser! + + +. general goals +.. Build process produces identical artefacts (bit-for-bit) from the same source and inputs +.. independent parties can rebuild and verify outputs match the original -> verify freedom from insider threat! +.. require a deterministic build environments +.. all build steps, dependencies, and tooling are tightly controlled and audited +. security goals: +.. detect tampering in build pipelines or artefacts +.. prevents hidden backdoors introduced during compilation or packaging by a malicious insider +.. ensure integrity of supply chain, dependencies and build tools +.. enables independent verification without trusting the original builder +.. drastrically reduce insider and supply chain attack surface +. Zero Trust: +.. never trust, always verify! +.. verifiable evidence (rebuild && compare) +.. eliminates implicit trust in build pipeline +.. build system considered untrustworthy +.. combine with signed artefacts and attestation frameworks for full supply chain integrity + + + + + ==== The whole implementation @@ -58,3 +90,6 @@ image::202-ThreatModel-SLSA4-ReproducibleBuilds-TrustAnchor.png[] === Motivation/Business Layer: Risk/Security Overlay image::203-SLSA4-ReproducibleBuilds-L1-Motivation.png[] + + +// end::inhalt[] diff --git a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html index 5bc2456..712e918 100644 --- a/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html +++ b/PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html @@ -6,7 +6,7 @@ -PLantUML Diagrams for GnuPG Key Signing +PLantUML Diagrams for GnuPG Key Signing and Reproducible Builds (SLSA4) + + + +

Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

+
»Ontological Analysis and Redesign of Risk Modeling in ArchiMate«
+
+
- +
  by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo.
  +
  +
  - +
    https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate
    +
  +
  +
+
+
+
»Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate«
+
+
- +
  by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello
  +
  +
  - +
    https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate
    +
  +
  +
+
+

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

Applied Examples: GnuPG Key Signing

The sub directory GnuPG-WoT-Download contains applied examples of the trust modeling. It is work in progress, but already contains some diagrams.

My goal is to model a reproducible builds distribution process with a zero trust architecture. And threat model it in PASTA as well as STRIDE.

Archimate Diagrams

+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +

Example from Paper		Applied to the NetBSD download
+ + + +		+ + + +
+ + + +		+ + + +
+ + + +		+ + + +
+ + + +		+ + + +
		+ + + +
		+ + + +

Example from Paper

Applied to the NetBSD download

+ + + \ No newline at end of file diff --git a/PlantUML-ModelingTrust/README.pdf b/PlantUML-ModelingTrust/README.pdf index dc64d84..6a87708 100644 Binary files a/PlantUML-ModelingTrust/README.pdf and b/PlantUML-ModelingTrust/README.pdf differ -- cgit v1.2.3