arXiv subjects

Chinenye Okafor

Publications and source records attributed to Chinenye Okafor.

4 recordsLinked to original sources

arXiv2026

Trustworthy and Confidential SBOM Exchange

Software Bills of Materials (SBOMs) have become a regulatory requirement for improving software supply chain security and trust by means of transparency regarding components that make up software artifacts. However, enterprise and regulated software vendors commonly wish to restrict who can view confidential software metadata recorded in their SBOMs due to intellectual property or security vulnerability information. To address this tension between transparency and confidentiality, we propose Petra, an SBOM exchange system that empowers software vendors to interoperably compose and distribute redacted SBOM data using selective encryption. Petra enables software consumers to search redacted SBOMs for answers to specific security questions without revealing information they are not authorized to access. Petra leverages a format-agnostic, tamper-evident SBOM representation to generate efficient and confidentiality-preserving integrity proofs, allowing interested parties to cryptographically audit and establish trust in redacted SBOMs. Exchanging redacted SBOMs in our Petra prototype requires less than 1 extra KB per SBOM, and SBOM decryption accounts for at most 1% of the performance overhead during an SBOM query

cs.CR↗

arXiv2025

DiVerify: Hardening Identity-Based Software Signing with Diverse-Context Scopes

Identity-based code signing enables software developers to digitally sign their code using cryptographic keys. This key is then linked to an identity (e.g., through an identity provider), allowing signers to verify both the code's origin and integrity. However, this code-identity binding is only as trustworthy as the mechanisms enforcing it. State-of-the-art identity-based code signing schemes present a major shortcoming: these schemes fail to provide verifiable information about the context in which a signature is generated. This verifiability is crucial given that modern attackers have subverted long-established security assumptions, namely, that the identity provider ecosystem, as well as signing software itself, is trusted. To address these issues, this paper introduces a diverse identity verification framework, DiVerify, that distributes identity-based verification across multiple entities and enforces stronger guarantees about the signing context. DiVerify makes it possible to provide end-to-end verifiability of not only a signer's identity (via multiple such signals), but also a signer's software stack (e.g., to verify no malware is present on a system at the time of signing). DiVerify is aimed at deployability, and leverages a meta-protocol to gather various trust signals and a binding mechanism to address the aforementioned, novel software supply chain attack vectors. We evaluate DiVerify's performance and confirm it is cheap to deploy and non-intrusive to developers: it only incurs a few kilobytes of additional storage (less than 0.4 percent of the average package size in widely used ecosystems like PyPI), and signing completes in under 100ms on a server-grade deployment.

cs.CR↗

arXiv2025

An Industry Interview Study of Software Signing for Supply Chain Security

Many software products are composed of components integrated from other teams or external parties. Each additional link in a software product's supply chain increases the risk of the injection of malicious behavior. To improve supply chain provenance, many cybersecurity frameworks, standards, and regulations recommend the use of software signing. However, recent surveys and measurement studies have found that the adoption rate and quality of software signatures are low. We lack in-depth industry perspectives on the challenges and practices of software signing. To understand software signing in practice, we interviewed 18 experienced security practitioners across 13 organizations. We study the challenges that affect the effective implementation of software signing in practice. We also provide possible impacts of experienced software supply chain failures, security standards, and regulations on software signing adoption. To summarize our findings: (1) We present a refined model of the software supply chain factory model highlighting practitioner's signing practices; (2) We highlight the different challenges-technical, organizational, and human-that hamper software signing implementation; (3) We report that experts disagree on the importance of signing; and (4) We describe how internal and external events affect the adoption of software signing. Our work describes the considerations for adopting software signing as one aspect of the broader goal of improved software supply chain security.

cs.SE↗

arXiv2024

SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques

cs.CR↗