Notation threat models

[yizha1]

Threat Model Information

Application Name	Application Version	Description	Document Owner	Participants	Reviewer
Notation	1.0	A tool to sign, store and verify artifacts

External Dependencies

Name	Description
Signer	The OS user who signs artifacts using notation
Verifier	The OS user who verifies artifacts against signatures using notation
File system	The file system where Notation is installed, and configuration files are stored and retrieved
Registry	A registry of Docker and Open Container Initiative (OCI) images, with support for all OCI artifacts
KMS	A Key Management Service for securely storing and accessing secrets

Data flow Diagram

• Notation sign using remote key
  

Title	STRIDE threat type	Threat Status	Priority	Description	Mitigations
Spoofing of the signer	Spoofing	Mitigated	High	an attacker may spoof Signer, and this may lead to unauthorized access to notation	Using a standard authentication mechanism to identify the external entity
Spoofing of the registry	Spoofing	Mitigated	High	an attacker may spoof the Registry, and this may lead to incorrect data delivered to notation	Using a standard authentication mechanism to identify the external entity
Spoofing of KMS	Spoofing	Mitigated	High	KSM may be spoofed by an attacker, and this may lead to incorrect data delivered to notation signing plugin	Using a standard authentication mechanism to identify the external entity
Inaccessible Registry	Denial of Service	Open	High	Denial of Service happens when the Registry is not able to service incoming requests or perform up to spec
Inaccessible KMS	Denial of Service	Open	High	An attacker prevents access to KMS on the other side of the trust boundary
Tampering with Configuration	Tampering	Mitigated	High	The configuration files may be tampered with by an attacker. This may lead to Notation sign using malicious configurations	using a standard authentication and authorization mechanism
Tampering with credentials	Tampering	Mitigated	High	Credentials be tampered with by an attacker. This may lead the authentication failure of notation	using a standard authentication and authorization mechanism
Tampering with certificate bundles	Tampering	Mitigated	High	Certificate bundles be tampered with by an attacker. This may lead to the failure of signature generation.	using a standard authentication and authorization mechanism
Tampering with the signature	Tampering	Open	High	The signature may be tampered with by an attacker. This may lead to fake signatures returned to notation

• Notation verify
  

Title	STRIDE threat type	Threat Status	Priority	Description	Mitigations
Spoofing of the verifier	Spoofing	Mitigated	High	an attacker may spoof verifier, and this may lead to unauthorized access to notation	Using a standard authentication mechanism to identify the external entity
Spoofing of the registry	Spoofing	Mitigated	High	an attacker may spoof the Registry, and this may lead to incorrect data delivered to notation	Using a standard authentication mechanism to identify the external entity
Inaccessible Registry	Denial of Service	Open	High	Denial of Service happens when the Registry is not able to service incoming requests or perform up to spec
Tampering with Configuration	Tampering	Mitigated	High	The configuration files may be tampered with by an attacker. This may lead to Notation sign using malicious configurations	using a standard authentication and authorization mechanism
Tampering with credentials	Tampering	Mitigated	High	Credentials be tampered with by an attacker. This may lead the authentication failure of notation	using a standard authentication and authorization mechanism

Reference

• Tools: https://github.com/OWASP/threat-dragon

[FeynmanZhou]

The mitigations are vague in the two tables. We might need to clarify what using a standard authentication and authorization mechanism means here.

[yizha1]

Please follow this PR for further discussions and comments.

#242