Re: [Suit] Surprising push back on the need for a customer to verify the trust relationship between a software supplier and software signer during digital signature validation on signed code

[Dick Brooks <[e-mail]>]

+1 “What is a “trustworthy credential” for you? “

And, most importantly from a SCRM perspective, how can a software consumer verify the trustworthiness of a software package, before installation, having only a signed, binary distribution of the software package in hand?

 

 

Thanks,

 

Dick Brooks



Never trust software, always verify and report! <https://reliableenergyanalytics.com/products>  ™

http://www.reliableenergyanalytics.com <http://www.reliableenergyanalytics.com/> 

Email: [e-mail] <mailto:[e-mail]> 

Tel: [phone]

 

From: Hannes Tschofenig <[e-mail]> 
Sent: Friday, June 11, 2021 2:34 AM
To: Phillip Hallam-Baker <[e-mail]>
Cc: [e-mail]; Brendan Moran <[e-mail]>; suit <[e-mail]>; Russ Housley <[e-mail]>
Subject: RE: [Suit] Surprising push back on the need for a customer to verify the trust relationship between a software supplier and software signer during digital signature validation on signed code

 

Hi Phil, 

 

a few clarifying questions. 

 

*	What is a “trustworthy credential” for you? 
*	Who is the “provider” here? 
*	What do you mean by “Must identify such machines”? Are you saying that the software / firmware update must identity the machine it applies to?
*	When you say “Every software distribution MUST be signed without exception” are you trying to distinguish between the signing the software vs. securing the distribution? With regards to the exception you are not talking about what happens during manufacturing.

 

Ciao

Hannes

 

From: Phillip Hallam-Baker <[e-mail] <mailto:[e-mail]> > 
Sent: Friday, June 11, 2021 12:22 AM
To: Hannes Tschofenig <[e-mail] <mailto:[e-mail]> >
Cc: [e-mail] <mailto:[e-mail]> ; Brendan Moran <[e-mail] <mailto:[e-mail]> >; suit <[e-mail] <mailto:[e-mail]> >; Russ Housley <[e-mail] <mailto:[e-mail]> >
Subject: Re: [Suit] Surprising push back on the need for a customer to verify the trust relationship between a software supplier and software signer during digital signature validation on signed code

 

I strongly disagree. Given my history of involvement in the WebPKI, I am certainly not biased against CAs. My concern is different.

 

I see multiple concerns:

 

1) Every software distribution MUST be signed without exception

 

2) All software executables and data installed on a machine MUST be signed by the provider.

 

3) All signatures MUST be under keys that have a trustworthy credential.

 

The reason I reject (3) is because I insist on (1) and (2). I want every piece of software to be signed on every machine without any exception whatsoever. That includes every development build, every open source project, every script written by the user. And that should apply to every desktop, laptop, tablet, mobile etc.

 

Thing is that I can't have the strong signing model I want if I also insist that every credential be an EV signature. It is one or the other. I choose everything signed.

 

 

For critical infrastructure devices, I suggest the following:

 

0) Must identify such machines and label them prominently

 

1) Software must be signed under trustworthy credential

 

2) Platform must verify signature before executable is launched.

 

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.