blob: 8e3721003d7a4b380dc72911a429f4ac4cdc2776 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
@startuml
left to right direction
skinparam rectangle {
BackgroundColor #FFF6F6
BorderColor #550000
}
skinparam note {
BackgroundColor #FFFFCC
}
right header
= Threat Model - Reproducible Builds according to SLSA Level 4
using independent GnuPG signatures and keys
as well as Reproducible Builds according to SLSA Level 4
corresponding to the Tor Browser release process, as well as NixOS, Debian and NetBSD
= %date("yyyy-MM-dd hh:mm")
endheader
right footer
= Advantages:
* Consistency between source code and binaries through Reproducible Builds
* No single trust anchor -> at least 2 independent builders
* Subsequent manipulation detectable through checksums in the Git Transparency Log
* Insider attacks made more difficult through multiple signatures
* Key misuse detectable through checksums in the Git Transparency Log and temporal correlation via timestamps
* Each box is a trust boarder
endfooter
caption
= Threat Model - Reproducible Builds according to SLSA Level 4
endcaption
actor "Downloader\n(Verifier)" as User #Green
actor "Internet\n(Insecure)" as Net
actor "NTP Server 1" as NTP1
actor "NTP Server 2 " as NTP2
actor "Attacker\n(Insider / External)" as Attacker #Red
'actor "Trusted Commiter 1" as Committer1
'actor "Trusted Commiter 2" as Committer2
actor "Keyserver 1" as Keyserver1
actor "Keyserver 2" as Keyserver2
rectangle "Maintainer" {
rectangle "Source Code\n(in Git)" as Source
rectangle "Git Release Tag\n(GnuPG-signed)" as Tag
}
rectangle "Independent build pipelines\n(at least 2)" {
rectangle "Pipe A" as B1
rectangle "Pipe B" as B2
}
rectangle "Download artefacts" {
rectangle "Artefact A\n(Checksum)" as A1
rectangle "Artefact B\n(Checksum)" as A2
}
rectangle "Git Transparency Log\n(tamper-hardened)" as Log
rectangle "Distributed ledger with\n Merkle Tree records\n (Blockchain)" as Ledger
rectangle "Operational environment\n(of the downloader)" {
rectangle "Known public signing keys\n(obtained from at least\n 2 independent trust paths)" as Keys
rectangle "Rebuild pipeline\n(Reproducible)" as Rebuild
rectangle "Verification policy\n (organisational measure\n from BSI TR)" as Policy
}
NTP1 --> Log : Time
NTP2 --> Log : Time
Keyserver1 --> Keys : retrieves
Keyserver2 --> Keys : retrieves
Source --> B1
Source --> B2
B1 --> A1
B2 --> A2
A1 --> Log : Checksum
A2 --> Log : Checksum
A1 --> Ledger : Checksum
A2 --> Ledger : Checksum
Tag --> Source
Net --> User
Attacker -[#Red]-> B1 : compromises
Attacker -[#Red]-> Net : controls
Attacker -[#Red]-> Tag : compromises private key
'// Commiter1 --> Tag : generates valid signature
'// Commiter2 --> Tag : generates valid signature
User --> Rebuild
User --> Log
Keys --> Policy
Rebuild --> Policy
Policy --> User : ACCEPT / REJECT
@enduml
|
