The Update Framework (TUF)

TUF is designed to survive key compromises without allowing attackers to install malicious updates. It uses a separation of duties across multiple roles (Root, Targets, Snapshot, Timestamp) with different keys stored at varying security levels.

• Offline keys: The Root role key is kept offline, making it extremely difficult to steal.
• Threshold signatures: A configurable number of keys are required to sign metadata, preventing a single compromised key from being sufficient.
• Key rotation: Compromised keys can be securely replaced through a defined process using the offline Root key.

TUF prevents rollback attacks and freeze attacks by ensuring clients always receive the most recent, intended updates.

• Timestamp role: A frequently re-signed, short-expiry file provides a non-repudiable statement about the latest version of other metadata.
• Version numbering: All metadata files have strictly increasing integer version numbers. Clients reject any metadata older than what they have already seen.
• Expiry enforcement: Every metadata file has a hard expiration date, forcing repositories to remain active and preventing the indefinite replay of stale, potentially vulnerable artifacts.

TUF provides robust mechanisms to revoke trust in compromised artifacts or keys, both proactively and reactively.

• Explicit revocation: The Targets metadata can explicitly list revoked files, ensuring clients know not to install them even if they are available on the mirror.
• Implicit revocation: If an attacker prevents a client from seeing a newer Targets metadata file, the file's expiration date will eventually pass, and the client will implicitly revoke trust in the old, un-refreshed metadata.
• Key revocation: The Root role can issue a new version of its metadata that removes trust in a compromised key, effectively revoking its power.

TUF's security model is based on a detailed threat analysis that maps specific roles to specific attack classes. The framework guarantees that a compromise of one or more low-security roles does not cascade into a full system breach.

• Timestamp key compromise: An attacker can only cause a denial-of-service by stopping updates, but cannot serve malicious files.
• Snapshot key compromise: An attacker can only roll back to a previous, correctly-signed set of metadata, but cannot introduce new malicious targets.
• Targets key compromise: An attacker can only serve malicious versions of files that the compromised Targets role is authorized to sign, limiting the blast radius.

TUF allows the primary Targets role to delegate trust for specific subsets of artifacts to other parties, enabling scalable and granular access control.

• Delegated roles: A project can delegate signing authority for a sub-project's files to that sub-project's team.
• Path patterns: Delegations can be scoped to specific file paths or glob patterns, ensuring a delegate can only sign for their designated artifacts.
• Terminating and non-terminating: Delegations can be configured to either stop searching for a target once found or continue searching other delegations, providing fine-grained control over artifact resolution.

TUF ensures that a client sees a consistent view of the repository at a single point in time, even when downloading from a mix of mirrors and a central repository.

• Snapshot role: This role aggregates the version numbers and hashes of all other metadata files, creating a single, consistent snapshot of the repository state.
• Atomic updates: A client first downloads the Snapshot metadata to know the exact set of files it should receive, preventing mix-and-match attacks where an attacker combines old and new metadata from different sources.
• Hash verification: All target files are cryptographically hashed in the Targets metadata, ensuring the downloaded artifact is exactly what was intended.

An append-only, cryptographically verifiable public ledger that records digital events such as code signatures and certificate issuances. This concept is central to TUF's timestamp role and the broader Certificate Transparency ecosystem.

• Makes certificate mis-issuance publicly detectable
• Uses Merkle trees for efficient cryptographic proofs
• Enables monitoring for unauthorized signatures
• TUF's timestamp metadata prevents rollback attacks using similar principles

A formal, machine-readable inventory of all components, libraries, and dependencies that constitute a software artifact. SBOMs provide the visibility necessary to know what TUF-secured updates are actually delivering.

• SPDX and CycloneDX are the dominant standards
• Enables precise vulnerability and license management
• Required by U.S. Executive Order 14028 for federal software
• Combined with TUF, ensures both transparency and integrity of updates

A deterministic compilation process allowing independent parties to recreate a bit-for-bit identical artifact from the same source code. This verifies that no tampering occurred during the build process, complementing TUF's protection of the distribution channel.

• Eliminates the build system as a single point of compromise
• Requires deterministic timestamps, file ordering, and toolchains
• Enables distributed verification of binary artifacts
• When combined with TUF, provides end-to-end verifiability from source to installation