Demystify Modern Signing: Keys, Certs, and Envelopes
summary
Compares Cosign, Notation, TUF and in-toto by walking signatures, envelopes and certificates, using Sigstore/Witness to mint an attestation and exporting the leaf certificate and public key; demonstrates identity-based signing with short-lived certificates (default 10-minute certificates), Rekor/timestamp authorities for proof, and verification via openssl + shasum. Reconstructs the Dizzy pre-auth encoding from the attestation but the live verification attempt fails (signature check doesn't validate), leaving certificate-chain and timestamp validation as required followups.
AI-written summary · about
chapters (9)
- 0:00Modern signing concepts
- 1:07Encryption basics for signing
- 3:35RSA vs elliptic curve keys
- 6:28Key management services
- 10:30Signing formats JSON COSE DIZZY
- 17:59Identity signing short-lived keys
- 20:27Verification trust chains
- 22:52Live demo Sigstore signing
- 31:28Q&A
related talks
15mDemystifying Digital Signatures
28mLife of a Sigstore Signature
17mWhose Sign Is It Anyway?
29mFrom Cosign to an Ecosystem: The Evolution of Sigstore
20mCryptographic Signatures: A Building Block Not A Panacea
27mNo Keys? No Problem: Why You Can Trust Sigstore Signatures
36mNot All That’s Signed Is Secure: Verify the Right Way with TUF and...
34m"Keyless" Code Signing Without Fulcio