This is the pages version of Stefan Schumacher’s Codeberg Repository at https://codeberg.org/0xKaishakunin/Architecture

It contains several architecural patterns and exercises with PlantUML with regards to modeling trust and zero trust architecture patterns

1. From GnuPG Keysigning Party to Reproducile Builds according to SLSA4

I am trying to model implicit and explicit trust in Zero Trust Architecture diagrams for Threat Modeling.

So I need to bring together the Blue Team/White Hat perspective and the Red Team/Black Hat stuff.

2. DFD: Keysigning Simple

100 GnuPG Keysigning DFD

3. SEQ: Keysigning with ID check and WoT

100 GnuPG Keysigning SEQ KSP WoT

4. NetBSD RelEng Attack STRIDE

The ISO Image is built, signed and uploaded to the WWW server, as well as the Signature file and checksums.

Evil Black Hat hacks the webserver, and swaps the ISO image for a manipulated one with a valid Signature.

The manipulated Signature verifies the fake-integrity of the manipulated ISO image, but not the authenticity.

300 NetBSD RelEng STRIDE

5. Supply-chain Levels for Software Artifacts

5.1. SLSA L1

A simple threat model for SLSA Level 1:

200 ThreatModel SLSA1 DownloadSig

5.2. Reproducible Builds SLSA L4

Modeling Trust, Trust Anchors and Boundaries and Attack Vectors for SLSA4:

The whole process draws heavy inspiration from those implemented by NetBSD, Debian, NixOS and the Tor Browser!

  1. general goals

    1. Build process produces identical artefacts (bit-for-bit) from the same source and inputs

    2. independent parties can rebuild and verify outputs match the original → verify freedom from insider threat!

    3. require a deterministic build environments

    4. all build steps, dependencies, and tooling are tightly controlled and audited

  2. security goals:

    1. detect tampering in build pipelines or artefacts

    2. prevents hidden backdoors introduced during compilation or packaging by a malicious insider

    3. ensure integrity of supply chain, dependencies and build tools

    4. enables independent verification without trusting the original builder

    5. drastrically reduce insider and supply chain attack surface

  3. Zero Trust:

    1. never trust, always verify!

    2. verifiable evidence (rebuild && compare)

    3. eliminates implicit trust in build pipeline

    4. build system considered untrustworthy

    5. combine with signed artefacts and attestation frameworks for full supply chain integrity

5.2.1. The whole implementation

  • Trust Boundaries: Rectangles

  • Attack Vectors: Red Arrows

201 ThreatModel SLSA4 ReproducibleBuilds

  • Trust Anchor: Green Anchor

202 ThreatModel SLSA4 ReproducibleBuilds TrustAnchor

5.3. Motivation/Business Layer: Risk/Security Overlay

203 SLSA4 ReproducibleBuilds L1 Motivation

6. Links

  1. GetPlantUML-CheatSheets.sh

    1. downloads some useful ArchiMate cheat sheets/overviews/examples via wget

  2. PlantUML-ModelingTrust

    1. Modeling Trust/Risk/Trust Anchors, Chains, and Boarders in Archimate, some TextBook patterns

  3. PlantUML-ModelingTrust/GnuPG-WoT-Download/README.html

    1. A GnuPG Key Signing Party and Download Signatures (SLSA1) as well as Reproducible Builds SLSA4 modeled in Archimate