in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes.

Torres-Arias, S., Afzali, H., Kuppusamy, T. K., Curtmola, R., & Cappos, J. (2019). in-toto: Providing Farm-to-Table Guarantees for Bits and Bytes. Proceedings of the 28th USENIX Security Symposium, 1393-1410.

Type

Conference paper

Intellectual base

Primary research

Year

2019

Link

https://www.usenix.org/conference/usenixsecurity19/presentation/torres-arias

Cited from

computer_science, history_historiography

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Provenance
  • This creates asymmetry: provenance is strong enough for most civil and commercial purposes but brittle against determined adversaries with institutional resources, a tamper-evidence/tamper-resistance distinction Torres-Arias et al. (2019) develop in the in-toto framework for software supply-chain integrity.

    This sourceUSENIX Association. Software supply-chain framework formalizing the gap between tamper-evident chains (signatures, attestations) and tamper-proof guarantees, with explicit threat-model analysis against state-level adversaries.

• Trusted Intermediary Compromise
  • The single structural correction the pattern prescribes — shift trust from the channel to the artefact — instantiates as reproducible builds, provenance attestation (proving the binary was built from the published source), and behavioral sandboxing of updates before deployment.

    This sourceProvides supply-chain provenance attestation proving an artefact was built from the published source.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:0323fd361ae3 · see in the full table