blob: 07b2634835774fa7d1b4ad0e571bb2a23e05b16f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
Date: 2021-08-10, 1300 CEST
Meet: https://membarrier.verkligendata.se/sigsum
Chair: rgdd
Agenda
* Hello
* Status round
* Discuss
* Next steps
Hello
* rgdd
* ln5
* kfreds
Status round
* [rgdd] witness cosigning (ongoing discussions with trustfabric)
* broader thoughts: https://github.com/sigsum/sigsum/blob/bbe8545b4b8f60676f019927616d2647dab58575/archive/2021-08-10--witnessing-broader-discuss
* api and format: https://github.com/sigsum/sigsum/blob/bbe8545b4b8f60676f019927616d2647dab58575/archive/2021-08-10--witnessing-api-updates
* current status
* investigating changes that would fix the attack we outlined
* after that we should start using the same format (Decision)
* [rgdd] 3m rump session talk at PETS on sigsum logging
* https://github.com/sigsum/sigsum/blob/bbe8545b4b8f60676f019927616d2647dab58575/archive/2021-08-10--rump-session-at-pets
* [rgdd] started looking into Ed25519ph with yubikey
Discuss
* Milestone: test run of feature-complete sigsum v0 log Oct-Dec
* Milestone: not sure how to formulate yet, but "mature witnessing"
* Milestone: project part, see decisions below
* Open TODOs
* sigsum (documentation, design)
* (Co)signed tree head format (doc + implement)
* Ed25519ph, SHA512/256?
* Decision: Landing page in doc repo & website (rgdd)
* Decision: Complete and merge design-framing doc branch (rgdd)
* Update API spec
* Decision: witness spec should be separate (rgdd)
* sigsum-log-go
* shard_hint (not enforced)
* domain_hint (not enforced)
* rate limits (not implemented)
* enhancement: server config
* enhancement: read-only mode
* enhancement: run with hsm
* refactor: move relevant parts into sigsum-lib-go
* refactor: get rid of old references of "stfe"
* sigsum-witness-py
* refactor: use new witnessing APIs when done
* refactor: get rid of old references of "stfe"
* enhancement: run with hsm
* tooling
* currently non-existing
* good exercise: add sigsum support in ST
* operations
* database
* alerts
* project
* recall notes from ln5: https://github.com/sigsum/sigsum/blob/bbe8545b4b8f60676f019927616d2647dab58575/archive/2021-06-21-self-hosted-services
* Decision: move to cgit (ln5)
* Decision: defer mailing list
* Decision: setup pastebin and pads (ln5)
* Decision: setup meet.sigsum.org (ln5)
* Decision: fix minimal landing page (rgdd)
Next steps
* Work towards the above milestones
* Near-term: fix the TODOs that were marked as decided
Other useful links
* [z4lem] academic papers that relate to sigsum threat model
* https://eprint.iacr.org/2007/060.pdf
* https://www.sciencedirect.com/science/article/abs/pii/S0161893807000592
|
