Back to DashboardIndustriesPhase 5 · Pilots & Migrationintermediate40 min

Software Supply Chain PQC

The signature links of a software supply chain read from their documents: a status map, the TUF and Uptane update frameworks, SLSA and in-toto provenance, and changing an algorithm after a verifier has shipped.

Why this matters: A software update is trusted because of a signature, and the documents that govern signing differ: some specify post-quantum signatures, some are drafts, one registry marks them experimental, and some editions are silent. The useful skill is reading each link from its own document and knowing which role, threshold and verifier a change would have to go through.

Start here: Open Roles and Thresholds, choose how many keys each update role has and how many an attacker holds, and see which roles the attacker can sign for on their own.

Practice in the Simulation

Software reaches a device through a series of hand-offs, and at each hand-off some control is meant to tell the receiver that what arrived is what was sent. Many of those controls are signatures. This lesson reads the signature links from their own documents, one link at a time, and says for each what the document states about post-quantum signatures and where it is silent.

The eight links, as this lesson draws them

This table is the lesson’s own map, not a statement from any source. It shows which kind of control each link relies on and where the topic is taught in depth, so that this lesson can leave those parts to the modules that own them.

1. Developer workstation and source (signature)

Signing keys and credentials held by people and tools

Taught in: Code Signing. Read in this lesson: Section 1.

2. Build (attestation)

Provenance: a record of how and where an artifact was built

Read in this lesson: Section 4.

3. Dependency inventory (SBOM) (attestation)

An inventory of components that its author can sign

Taught in: SBOM. Read in this lesson: Section 4.

4. Release artifact (hash and signature)

A hash or signature that the consumer checks before use

Taught in: Code Signing. Read in this lesson: Sections 1 and 2.

5. Registry or transparency log (log)

A recorded entry that others can inspect

Taught in: Code Signing. Read in this lesson: Section 2.

6. Pipeline policy gate (policy)

A rule that admits or rejects an artifact in the pipeline

Taught in: Platform Engineering

7. Update delivery (signature)

Signed metadata from roles that need a threshold of keys

Read in this lesson: Section 3.

8. Device verifier (signature)

Boot ROM or updater code that checks signatures on the device

Taught in: Secure Boot, IoT. Read in this lesson: Section 5.

Two sourced statements anchor the map. The first is from NIST’s Secure Software Development Framework, the second from its guidance on integrating supply chain security into DevSecOps.

NIST SP 800-218 (SSDF) task PS.2.1 asks that software integrity verification information be made available to software acquirers; its notional implementation examples include posting cryptographic hashes for release files on a well-secured website, using an established certificate authority for code signing so that consumers' operating systems or other tools and services can confirm the validity of signatures before use, and periodically reviewing the code signing processes, including certificate renewal, rotation, revocation and protection.

Source: NIST SP 800-218 v1.1, PS.2.1 table (Release Integrity)

NIST SP 800-204D says a robust software supply chain security programme needs artifacts such as a software bill of materials and frameworks for the attestation of software components; its section on attack targets notes that a developer's workstation typically holds cryptographic materials such as software artifact signing keys; and it says a common approach is to generate as much provenance data as possible.

Source: NIST SP 800-204D, February 2024, Scope; Attack Targets; workflows

What this lesson leaves to other modules

Check off all sections and mark this reading done.

Related modules

Check your understanding

8 questions on Software Supply Chain PQC, each with its answer and the reason.

Take the quiz

Next step

Produce the artifact: Deployment Playbook

This module belongs to phase 5 (Pilots & Migration); Deployment Playbook produces a deliverable of that phase in the Command Center.

Learning module content can be inaccurate. Please double-check its information. Report inaccuracies in PQC Today GitHub Discussions.