When The Going Gets Tough, Get TUF Going!
summary
Explains that The Update Framework (TUF) encodes five signed roles—root, timestamp, snapshot, targets and delegations—with per-role expirations and hash-linked snapshots to stop replay freeze and rollback attacks; shows a working implementation, Notary, integrated into docker content trust, with CLI demo of init/add/publish/verify and live key rotation where a new snapshot key is signed by the root to recover from compromise, and describes hardware-backed root keys (YubiKey) and delegation plus threshold signing for maintainers.
AI-written summary · about
chapters (6)
- 0:00Start
- 6:28Freeze and Rollback Attacks?
- 7:13Survivable Key Compromise?
- 8:07Trust Thresholding?
- 16:29Targets Metadata
- 17:01Delegation Metadata
related talks
34mWhen the Going Gets Tough, Get TUF Going! [I]
36mTUF / Notary Project Intro
41mDeep Dive: TUF / Notary
22mSecuring Content Repositories with the Update Framework (TUF)
42mTUF / Notary Deep Dive
29mTUF-en up Your Software Supply Chain
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution
41mUsing TUF to Mitigate Repository Compromises