Add more text describing threshold computation #154
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joshuagl
force-pushed
the
joshuagl/calculate-threshold
branch
from
c6a3f8c to
a98c6a5
Compare
|
Rebased on the latest master with a new version and date added. Please take a look @trishankatdatadog @mnm678 |
mnm678
previously approved these changes
May 29, 2021
joshuagl
force-pushed
the
joshuagl/calculate-threshold
branch
from
a98c6a5 to
215d10b
Compare
|
Almost two years later !? 🙊 I've managed to add some more text in an attempt to address @trishankatdatadog's concerns. I rebased on the latest changes and updated version and date. With the current version and date in the commit this PR SHOULD follow #272 |
joshuagl
force-pushed
the
joshuagl/calculate-threshold
branch
from
215d10b to
f1b6165
Compare
Several implementations have made similar errors -- counting multiple signatures by the same keyid -- when implementing signature threshold computation, for example the reference implementation: GHSA-pwqf-9h7j-7mv8 theupdateframework/python-tuf@83ac7be Add some extra description to the detailed client workflow to further explain that a threshold of signatures should only count one signature per key. Signed-off-by: Joshua Lock <[email protected]>
In an attempt to help implementers protect against incorrect threshold computation, update "File formats" to suggest that the signatures list contain only a single signature per keyid at metadata creation time. Suggested-by: Jussi Kukkonen <[email protected]> Signed-off-by: Joshua Lock <[email protected]>
Be more explicit that each KEYID can only count one signature towards the threshold. Signed-off-by: Joshua Lock <[email protected]>
Signed-off-by: Joshua Lock <[email protected]>
joshuagl
force-pushed
the
joshuagl/calculate-threshold
branch
from
f1b6165 to
ec2e1ac
Compare
|
I'd love to get this PR off my backlog, any chance of some reviews @trishankatdatadog, @mnm678 and @lukpueh ? |
mnm678
approved these changes
Aug 17, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add some additional text to each "Check for an arbitrary software attack" section describing threshold computation, in an attempt to help TUF implementers avoid falling into the trap of a naive implementation of threshold counting resulting in incorrect, security affecting, behaviour.
Further enhance this guidance by recommending, in "File formats", that the signatures list only contain one signature per keyid.
This kind of detail will be easier to add in a much clearer way once we rewrite the workflow to call out to subsections (#121), however I wanted to add this information as soon as possible because we continue to see implementers falling into the same trap: