Paul MeyerReproducible builds are a valuable property for remote attestation workflows but often hard to maintain. We faced a special challenge building reproducible artifacts that contain signatures.
Together with @Euler I wrote a blog post about how we used ECDSA public key recovery to generate signatures that match exactly one artifact, can be reproduced by a verifier, and are secure, without anyone ever knowing a private key.
https://katexochen.aro.bz/posts/reproducible-secure-signatures/
#ReproducibleBuilds #RemoteAttestation #Cryptography #ConfidentialComputing #Infosec
Secure signatures without a private key
Reproducible builds allow anyone to verify that a binary matches its source code. But what if the build artifact must contain a cryptographic signature? Reproducing the signature requires the private key, which defeats the purpose of reproducibility. In this post, we present a technique based on ECDSA public key recovery that produces signatures which are both secure and fully reproducible, without anyone ever knowing a private key. Build artifacts with signatures - a reproducibility issue Remote attestation is a fundamental part of Confidential Computing. It can be used to prove what software is running in a remote environment. Users of such an attested environment do not need to trust the software vendor, excluding them from the trusted computing base1.
Ethan Black
Carlos Solís
Carlos Solís
Timothée Ravier
Cory Doctorow
[nate@social0 ~]$ 
Gokul Das
EFF