Commit-Then-Disclose: Cryptographic SBOM Auditing Without IP Leakage
summary
A system builds an SBOM Merkle tree and a separate commitment root with nonces so auditors can request and verify single components without seeing the rest; proofs use SHA-256 prefixes to prevent second‑preimage attacks. Integrated into CI/CD with Cosign, CycloneDX, Grype, in-toto and TUF, the crypto adds negligible overhead — 0.26 ms build time for 400 components and proof verification stays logarithmic up to 50,000 components with P99 ≈ 5.46 ms and demo deployment and gating succeed.
AI-written summary · about
chapters (11)
- 0:00Commit-Then-Disclose
- 1:05Software Bill of Materials
- 3:33SBOM governance conflicts
- 5:18Merkle trees for selective disclosure
- 9:14Merkle and commitment trees
- 12:39SBOM auditing in CI/CD
- 17:55Enforcing SBOM policies in Kubernetes
- 21:04Rerandomization for privacy
- 23:44Benchmarking cryptographic overhead
- 27:07Scaling to 50,000 components
- 28:52Q&A
related talks
32mCryptographic Governance: Software Supply Chain Security With CBOM
37mSecuring OSS across the whole supply chain and beyond
23mMastering Secure Software Supply Chains
22mTop 5 Reasons (and 5 Myths Debunked) to Invest in Securing the Software Supply Chain
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End
41mYour SBOM Is Lying To You – Let’s Make It Honest
01h 16mCybersecurity with CDF & OpenSSF Focus Group
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...