Comparing TUF and Transparent Logs

[Marina Moore]

Hi,

A few of us at NYU have been working on a comparison between TUF and Transparent Logs (like Certificate Transparency). We created a document (https://docs.google.com/document/d/1gyy7sdR6RZtIWwrlKHVSJOvO0cnKTDMcgOPl6yDgmgM) that describes how the threat model for each of these approaches differ and the benefits gained from each technology. They can both be used to protect against tampering with packages, but provide different specific benefits.

If you are interested, feel free to take a look and leave us some feedback on the document, or share it with others if this topic ever comes up in discussions about TUF.

Thanks,

Marina

[Trishank Kuppusamy]

Awesome, thanks for sharing, Marina!

[Sumana Harihareswara]

Thanks for writing this and sharing it, TUF team!

If this is going to be a document that is long-lived and that people are meant to share with each other, I hope it will move soon to https://theupdateframework.com/ or https://ssl.engineering.nyu.edu/blog/ and have a meaningful URL, byline, clear "posted/last updated" date, and so on. If it's part of the TUF documentation at https://theupdateframework.com/ then it'll be reasonably easy to update it with pull requests.

-Sumana Harihareswara

[Trishank Kuppusamy]

On Thu, Jan 16, 2020 at 5:21 PM Sumana Harihareswara <con...@changeset.nyc> wrote:

If this is going to be a document that is long-lived and that people are meant to share with each other, I hope it will move soon to https://theupdateframework.com/ or https://ssl.engineering.nyu.edu/blog/ and have a meaningful URL, byline, clear "posted/last updated" date, and so on. If it's part of the TUF documentation at https://theupdateframework.com/ then it'll be reasonably easy to update it with pull requests.

💯

We will await feedback on the Google Doc today, but will move it to a blog post (thanks to +Marina Moore and +Lois Anne Delong) early next week...

[Trishank Kuppusamy]

The blog post is finally here:

https://ssl.engineering.nyu.edu/blog/2020-02-03-transparent-logs

Fire away, especially if you spot any mistake or misunderstanding!