blob: 4371bf5edc470ead94b32ee0737e860e7ee405b3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
@startuml
left to right direction
skinparam rectangle {
BackgroundColor #F9F9F9
BorderColor #333
}
right header
= Threat Model - Integrity verification of download artifacts with key list!
using independent GnuPG signatures and public keys
as well as a key list with authorised signing keys
= %date("yyyy-MM-dd hh:hh") UTC
endheader
right footer
* Maintainer publishes signed artifacts, public GnuPG keys and signed key list
* The key list or its signature is the central trust anchor
* Both are located in a central place!
* If the key list and the information about signature authorisation of the key list are replaced, manipulated artifacts with valid signatures can be distributed
* The security objective authenticity of the artifacts can therefore be violated
endfooter
actor "Downloader\n(Verifier)" as User #Green
actor "Attacker\n(MITM / Mirror)" as Attacker #Red
' actor "Keyserver" as Keyserver
' actor "Website with signed key list\nand information about signature authorisation of the key list" as WWW #Orange
rectangle "Maintainer" {
rectangle "Private key\n(on hardware token)" as PrivKey
rectangle "Release artifact\n(binary)" as Artifact
rectangle "Signature\n(.asc)" as Sig
}
rectangle "Website with signed key list\nand information about signature authorisation of the key list" as Channel #Orange
rectangle "Verification environment\n(Server)" {
rectangle "Public key\nfrom keyserver\n(fingerprint verified)" as PubKey
rectangle "gpg --verify *.asc" as GPG
}
PrivKey --> Sig : signs
Artifact --> Sig
Sig --> Channel
Artifact --> Channel
Channel --> User
' Attacker -[#Red]-> Channel : MITM attack
Attacker -[#Red]-> Channel: replaces key list
' Keyserver --> User: retrieves public keys
Channel --> User: retrieves key list and verifies its signature
User --> GPG
PubKey --> GPG
Artifact --> GPG
Sig --> GPG
GPG --> User : OK / FAIL
@enduml
|
