CHAINIAC: Proactive Software-Update Transparency via Collectively Signed Skipchains and Verified Builds 1 Kirill Nikitin , 1 Eleftherios Kokoris-Kogias, 1 Philipp Jovanovic, 1 Linus Gasser, 1 Nicolas Gailly, 2 Ismail Kho ffi , 3 Justin Cappos, 1 Bryan Ford 1 École polytechnique fédérale de Lausanne (EPFL) 2 University of Bonn 3 New York University
Software Updates A program tape for the 1944 Harvard Mark I, Hilary Mason's Twitter one of the first digital computers. Wikipedia. 2
Software Updates • Softwares updates are used to patch disclosed vulnerabilities, add new features, and improve security posture • If you do not update your system, things can go bad… Forbes The Verge The Sun 3
Software Updates • But even if you do update your system regularly, things can go wrong too… • Software-update systems are a lucrative attack target due to their centralized design and potential impact on users How can we make software-update systems more secure and transparent? 4
Software Release Pipeline Development/Review – Building release binaries – Sign-o ff – Release distribution Distribution center Developers </CODE> Users 5
Software Release Pipeline Development/Review – Building release binaries – Sign-o ff – Release distribution Build server Distribution center Developers ⚙ ⚙ </CODE> Users 6
Software Release Pipeline Development/Review – Building release binaries – Sign-o ff – Release distribution Build server Distribution center Developers ⚙ ⚙ </CODE> Users 7
Software Release Pipeline Development/Review – Building release binaries – Sign-o ff – Release distribution Build server Distribution center Developers </CODE> Users 8
Challenges 1. Make software-update process resilient to partial key compromise Build server Distribution center Developers </CODE> Users 9 9 9
Challenges 1. Make software-update process resilient to partial key compromise Build server Distribution center Developers </CODE> Users 10 10 10
Challenges 1. Make software-update process resilient to partial key compromise Build server Distribution center Developers </CODE> Users 11 11 11
Challenges 1. Make software-update process resilient to partial key compromise Kaspersky Securelist Talos report on Mashable Petya/NotPetya attacks 12 12 12
Challenges 2. Prevent malicious substitution of a release binary during building process Build server Distribution center Developers </CODE> Users 13 13 13
Challenges 2. Prevent malicious substitution of a release binary during a build process Build server Distribution center Developers ⚙ ⚙ </CODE> Users 14 14 14
Challenges 2. Prevent malicious substitution of a release binary during a build process Build server Distribution center Developers </CODE> Users 15 15 15
Challenges 2. Prevent malicious substitution of a release binary during a build process Over 90% of the source packages included in Debian 9 will build bit- for-bit identical binary packages 16
Challenges How many of you have reproducibly built software binaries for personal use? 17
Challenges 2. Prevent malicious substitution of a release binary during a build process Closed-source software? Building the Tor Browser bundle takes 32 hours on a modern laptop 18
Challenges 3. Protect users from targeted attacks by coerced or bribed developers Build server Distribution center Developers Users 19 19 19
Challenges 3. Protect users from targeted attacks by coerced or bribed developers Build server Distribution center Developers Users 20 20 20
Challenges 3. Protect users from targeted attacks by coerced or bribed developers Build server Distribution center Developers ⚙ ⚙ </CODE> </CODE’> Users 21 21 21
Challenges 3. Protect users from targeted attacks by coerced or bribed developers Build server Distribution center Developers </CODE> </CODE’> Users 22 22 22
Challenges 3. Protect users from targeted attacks by coerced or bribed developers Build server Distribution center Developers </CODE> </CODE’> Users 23 23 23
Challenges 4. Enable developers to securely rotate their signing keys in case of renewal or compromise Distribution Build center server Developers Users 24 24 24 24
Challenges 4. Enable developers to securely rotate their signing keys in case of renewal or compromise Distribution Build center server Developers Users 25 25 25 25
Challenges 4. Enable developers to securely rotate their signing keys in case of renewal or compromise Distribution Build center server Developers Users 26 26 26 26
Challenges 4. Enable developers to securely rotate their signing keys in case of renewal or compromise Distribution Build center server Developers Users 27 27 27 27
Design of CHAINIAC 28
Roadmap to CHAINIAC Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 29
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Developers User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 30
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Developers User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 31
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Distribution center Developers ⚙ User Release Release <source code> <binary> Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 32
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Distribution center Developers ⚙ User Release Release <source code> <binary> Developers’ Policy signatures Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 33
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Distribution center Developers User Release <binary> Developers’ Policy signatures Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 34
Decentralized Release-Approval 1. Make software-update process resilient to partial key compromise Distribution center Developers User Policy Release <binary> Developers’ signatures Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 35
Background • Collective Authority (Cothority), Collective Signing (CoSi), and BFT-CoSi Authoritative statements: e.g. log records 1 record 2 record 3 record each statement collectively signed by both authority Authority and all or most witnesses Witness Cosigners References • Ewa Syta, Iulia Tamas, Dylan Visher, David Isaac Wolinsky, Philipp Jovanovic, Linus Gasser, Nicolas Gailly, Ismail Kho ffi , and Bryan Ford. Keeping Authorities “Honest or Bust” with Decentralized Witness Cosigning. In 37th IEEE Symposium on Security and Privacy , May 2016. • Eleftherios Kokoris-Kogias, Philipp Jovanovic, Nicolas Gailly, Ismail Kho ffi , Linus Gasser, and Bryan Ford. Enhancing Bitcoin Security and Performance with Strong Consistency via Collective Signing. In Proceedings of the 25th USENIX Conference on Security Symposium , 2016. 36
Verified Builds 2. Prevent malicious substitution of a release binary during building process Distribution Developers center Cothority Release Tree <source code> <binaries> Developers’ signatures User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 37
Verified Builds 2. Prevent malicious substitution of a release binary during building process Distribution Developers center Cothority Release Tree <source code> ⚙ ⚙ <binaries> Developers’ ⚙ signatures User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 38
Verified Builds 2. Prevent malicious substitution of a release binary during building process Distribution Developers center Cothority Release Tree <source code> ⚙ ⚙ <binaries> Co-signature ⚙ User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 39
Verified Builds 2. Prevent malicious substitution of a release binary during building process Distribution Developers center Cothority Release Tree <source code> <binaries> ⚙ ⚙ Co-signature ⚙ Download & Verify User Policy Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 40
Verified Builds Release Policy File - List of individual developer public keys - Signing threshold - Cothority public key - Supported platforms for verified builds - … Decentralized Verified Builds Anti-equivocation Key Evolution Release Approval 41
Recommend
More recommend
