Intro: TUF / Notary
summary
TUF (spec) and Notary (Go implementation) provide signed metadata, automatic recovery from stolen keys, and practical revocation so a compromised server or stolen HSM-stored key no longer yields permanent breach. Notary already covers about 80% of cloud‑native use and is in automotive fleets; TUF supports offline key rotation and threshold signing (e.g. configurable four‑of‑six or 2‑of‑3 schemes). Integration hooks exist for Docker, Kubernetes admission controls and Helm; current work addresses moving signed artifacts between registries.
AI-written summary · about
chapters (21)
- 0:00Start
- 0:54There exists an attack vector
- 1:40Doesn't crypto just work?
- 2:01SSL/TLS (online key)
- 2:34GPG (offline key)
- 3:25Attack: Slow Retrieval
- 4:24Attock: Zip Bomb
- 4:47Attack: Duplicate Files in Zip
- 6:13Attack: Freeze Attack
- 7:04Attack: Extraneous Dependencies
- 7:32Attack: Depends on Everything
- 7:54Attack: Provides Everything
- 9:32Attack: Compromise
- 14:02Explicit & Implicit Revocation
- 15:30Responsibility Separation
- 17:19Minimize Risk
- 18:22Multi-signature Trust
- 18:51Roles in TUF
- 20:00TUF Key Hierarchy
- 21:16Notary
- 21:50Integrations
related talks
36mTUF / Notary Project Intro
34mWhen the Going Gets Tough, Get TUF Going! [I]
26mTUF-En Up Your Signatures
33mIntroduction to Notary
42mTUF / Notary Deep Dive
29mTUF-en up Your Software Supply Chain
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
41mWhen The Going Gets Tough, Get TUF Going!