Cryptographic Signatures: A Building Block Not A Panacea
summary
Cryptographic signatures guarantee only that a particular private key signed an artifact at a point in time and require surrounding policies to be meaningful. The talk explains verification choices, online versus offline key storage, delegations and threshold/multi-signatures for compromise resilience, and how systems actually use them: Notation and Cosign + Rekor attach signatures to OCI registries, TUF mandates offline root keys and delegation chains, and in-toto ties identities to supply-chain steps for enforceable verification.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:58How do they work
- 1:34What does it mean
- 2:10Things to think about
- 2:57Why use signatures
- 3:40Compromise resilience
- 4:21Verification
- 5:36Storage
- 6:58Establishing Trust
- 8:41Trust Limitations
- 9:24Delegations
- 10:20Multisignatures
- 11:28Signature Projects
- 11:51Notation
- 12:53Cosine
- 13:45Update Framework
- 16:28Entoto
- 16:57Thresholds
- 17:22Contact Info
- 18:38Template
related talks
17mWhose Sign Is It Anyway?
36mNot All That’s Signed Is Secure: Verify the Right Way with TUF and...
15mDemystifying Digital Signatures
34mPolicy Compliance with Sigstore: From Signing Software to Validating the Whole Softwar...
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
33mDemystify Modern Signing: Keys, Certs, and Envelopes
31mSign, Attest, and Verify! A Practical Guide for Software Supply...
26mWho's Verifying Your Signatures? Approaching Private Container Image Signing