How is software made? 2 A stylized software supply chain test - PowerPoint PPT Presentation

in-toto -- Securing the whole software supply chain Santiago Torres-Arias, Hammad Afzali, Lukas Pühringer , Reza Curtmola, Justin Cappos

How is software made? 2

A stylized software supply chain test code build package 3

Attackers can hack the software supply chain test code build package 4

Attackers do hack the software supply chain 5

Attackers do hack the software supply chain 6

Attackers do hack the software supply chain 7

Attackers do hack the software supply chain 8

Attackers do hack the software supply chain 9

How can we fix this? 10

Many good point solutions test code build package 11

Many good point solutions test → git signing, reference state log [Torres USENIX Sec 16] , ... code build package 12

Many good point solutions test → git signing, reference state log [Torres USENIX Sec 16] , ... code build package → TPMs, HSMs, reproducible builds, ... 13

Many good point solutions test → git signing, reference state log [Torres USENIX Sec 16] , ... → TLS, GPG, TUF code build package → TPMs, HSMs, reproducible builds, ... 14

Fixed? 15

Gaps between steps? Compliance? test code build package 16

We want to secure the complete Software Supply Chain! → Verifiably define the steps of the software supply chain → Verifiably define the authorized actors → Guarantee that everything happens according to definition, and nothing else 17

in-toto -- Project Definition -- Steps { "_type": "layout", "expires":"2017-08-31T12:44:15Z", "keys": { "0c6c50": { ... } }, "signatures": [...], "steps": [{ "_type": "step", "name": "checkout-code", "expected_command": ["git", "clone", "..."], "expected_materials": [], "expected_products": [ ["CREATE", "demo-project/foo.py"], ...], "pubkeys": ["0c6c50..."], "threshold": 1 }, ...], "inspections": [...] } 18

in-toto -- Project Definition -- Functionaries Dave { "_type": "layout", "expires":"2017-08-31T12:44:15Z", "keys": { "0c6c50": { ... } Bob }, "signatures": [...], Erin "steps": [{ "_type": "step", "name": "checkout-code", "expected_command": ["git", "clone", "..."], "expected_materials": [], "expected_products": [ ["CREATE", "demo-project/foo.py"], ...], "pubkeys": ["0c6c50..."], "threshold": 1 }, ...], "inspections": [...] } Carol 19

in-toto -- Project Definition -- Materials/Products Dave { "_type": "layout", "expires":"2017-08-31T12:44:15Z", "keys": { "0c6c50": { ... } Bob }, "signatures": [...], Erin "steps": [{ "_type": "step", "name": "checkout-code", "expected_command": ["git", "clone", "..."], "expected_materials": [], "expected_products": [ ["CREATE", "demo-project/foo.py"], ...], "pubkeys": ["0c6c50..."], "threshold": 1 }, ...], "inspections": [...] } Carol 20

in-toto -- Project Definition -- Rules Dave { "_type": "layout", "expires":"2017-08-31T12:44:15Z", "keys": { "0c6c50": { ... } Bob }, "signatures": [...], Erin "steps": [{ "_type": "step", "name": "checkout-code", "expected_command": ["git", "clone", "..."], "expected_materials": [], "expected_products": [ ["CREATE", "demo-project/foo.py"], ...], "pubkeys": ["0c6c50..."], "threshold": 1 }, ...], "inspections": [...] } Carol 21

in-toto -- Project Definition -- Signed Alice Dave { "_type": "layout", "expires":"2017-08-31T12:44:15Z", "keys": { "0c6c50": { ... } Bob }, "signatures": [...], Erin "steps": [{ "_type": "step", "name": "checkout-code", "expected_command": ["git", "clone", "..."], "expected_materials": [], "expected_products": [ ["CREATE", "demo-project/foo.py"], ...], "pubkeys": ["0c6c50..."], "threshold": 1 }, ...], "inspections": [...] } Carol 22

in-toto -- Signed Evidence for each Step $ in-toto-run -- ./do-the-supply-chain-step { { { { "_type": "Link", "_type": "Link", "_type": "Link", "_type": "Link", "name": "code", "name": "build", "name": "build", "name": "build", "byproducts": "byproducts": "byproducts": "byproducts": {"stderr": "", "stdout": {"stderr": "", "stdout": {"stderr": "", "stdout": {"stderr": "", "stdout": ""}, ""}, ""}, ""}, "command": [...], "command": [...], "command": [...], "command": [...], "materials": {}, "materials": {...}, "materials": {}, "materials": {}, "products": { "products": { "products": { "products": { "foo": {"sha256": "foo": {"sha256": "foo": {"sha256": "in-toto/.git/HEAD": "..."}}, "..."}}, "..."}}, {"sha256": "..."}}, "return_value": 0, "return_value": 0, "return_value": 0, "return_value": 0, "signatures": [...] "signatures": [...] "signatures": [...] "signatures": [...] } } } } 23

DEMO: Grep -- Debian’ized & in-toto’ized fetch extract modify build (dget) (dpkg-source) ( interactive ) (dpkg-buildpackage) 24

DEMO: Grep -- Debian’ized & in-toto’ized $ in-toto-run <opts> -- dget http://cdn.debian.net/debian/pool/main/g/grep/grep_2.12-2.dsc $ in-toto-run <opts> -- dpkg-source -x grep_2.12-2.dsc $ cd grep-2.12 $ in-toto-record start <opts> $ dch -i $ vi debian/rules $ in-toto-record stop <opts> $ in-toto-run <opts> -- dpkg-buildpackage -us -uc $ in-toto-verify --layout-keys <key> --layout grep_2.12-2.layout → goo.gl/hgPMHA (demo screencast + demo metadata) 25

DEMO: Grep -- Debian’ized & in-toto’ized fetch extract modify build (dget) (dpkg-source) ( interactive ) (dpkg-buildpackage) 26

Layout wizard (sneak preview) 27

Thank You! Questions? https://in-toto.io/ jcappos@nyu.edu 28