TUF / Notary Project Intro
summary
TUF provides a compromise-resilient key roles model (root, targets, snapshot, timestamp) that separates duties so key rotation and revocation work without breaking clients; Notary is a production Go implementation with a client, HTTP server, and a signer that holds the timestamp key and encrypts private keys at rest. Docker uses it for content trust, multiple vendors deploy TUF (cloud providers, package managers, even automobiles), and at least one major US automaker mandates a TUF variant.
AI-written summary · about
chapters (29)
- 0:00Introduction
- 0:47Overview
- 1:08Digital Signing
- 1:31Asymmetric Cryptography
- 2:43GPG
- 3:30Integrity
- 6:02Revocation
- 6:55Additional Problems
- 7:10Software gets old
- 7:27Vulnerability discovery
- 7:42Installing newer software
- 8:47Distribution properties
- 9:08Compromises
- 10:45Mirror Detection
- 11:33Update Framework Goal
- 12:11Key Roles
- 16:00Trust Model
- 16:15Key Frequency
- 17:55Thresholds
- 19:12Initial Trust
- 19:31Whitelisting
- 20:13Key Management
- 21:41MultiSignature Trust
- 22:52Metadata
- 24:50Notary
- 25:31Architecture
- 28:31Additional Features
- 30:37Learn More
- 31:38Target vs Snapshot
related talks
39mIntro: TUF / Notary
34mWhen the Going Gets Tough, Get TUF Going! [I]
41mDeep Dive: TUF / Notary
41mWhen The Going Gets Tough, Get TUF Going!
33mIntroduction to Notary
26mTUF-En Up Your Signatures
29mTUF-en up Your Software Supply Chain
18mBeyond signatures: Using TUF and Notary to Secure Software Distribution