search

sigstore / rekor-monitor

Log monitor for Rekor to verify immutability and monitor entries
Apache License 2.0
23 stars 24 forks source link

Alert only for certificates issued from a set of trusted roots #378

Open haydentherapper opened 2 months ago

haydentherapper commented 2 months ago

Description

Rekor accepts certificates from any issuer, including self-signed certificates. A malicious entity or spammer could issue certificates using someone's identity and OIDC issuer to trigger an alert for a monitor. This can be mitigated by verifying the certificate chains up to a trusted root. For the public instance, the monitor can pull in the trusted PKI from Sigstore's TUF repo.

This should be configurable, since this may be used for self-hosted instances.

haydentherapper commented 1 month ago

One comment from the linked thread on rekor is that it is possible to have a freeze attack against local metadata up to the expiration of the timestamp. This would delay fetching the latest trust root and could result in an entry being ignored. We could add a configuration to always fetch the latest TUF metadata regardless of timestamp if this is a concern based on the users threat model.