diff --git a/content/summit2026/confirmed-talks.html b/content/summit2026/confirmed-talks.html index 6fdcf28..4383aef 100644 --- a/content/summit2026/confirmed-talks.html +++ b/content/summit2026/confirmed-talks.html @@ -15,10 +15,10 @@

- Matthew McPherrin + Ben Birt - How Let's Encrypt is deploying Merkle Tree Certificates + ⚡ Git-ratchet: tooling for Git commit transparency @@ -26,15 +26,39 @@

Hayden Blauzvern - Simplicity through Transparency: How the PQC Migration is Streamlining Sigstore + Simplicity through Transparency: How the PQC Migration is Streamlining Sigstore - Ben Birt + Matthieu Daumas + + + ⚡ Archive Transparency + + + + + Billy Lau + + + Sostenuto: Scaling & Sustaining Android Binary Transparency + + + + + Matthew McPherrin + + + How Let's Encrypt is deploying Merkle Tree Certificates + + + + + Niels Möller - Git-ratchet: tooling for Git commit transparency + The TKey sign-if-logged tool diff --git a/content/summit2026/talks/archive.md b/content/summit2026/talks/archive.md new file mode 100644 index 0000000..644f845 --- /dev/null +++ b/content/summit2026/talks/archive.md @@ -0,0 +1,38 @@ +--- +url: summit2026/talks/archive +layout: summittalk +title: "Archive Transparency" +topImage: +type: lightning +room: +start: +speaker: Matthieu Daumas +speakerTitle: +--- + +
+ +Everyday online resources move, change, or disappear, making users rely +on third-party repositories to keep the past available for them. The +good reputation of these repositories makes them attractive targets for +quiet tampering by attackers. This threatens trust in the authenticity +of historical records, especially in an era of mechanized intelligence. + +This talk will introduce Archive Transparency, a prototype that +explores how transparency logs, Sigsum, and the witness network can +solve this issue by establishing that a third-party repository content +has remained unchanged over a long time. This talk will conclude with +data from a small-scale deployment. + +--- + +### Speaker + +Matthieu Daumas is a software engineer based in Berlin, Germany, with a +background in compile-time cryptography and obfuscating compilers. +Since 2024, he has been developing Archive Transparency, an open-source +prototype exploring transparency logs for archival integrity. He is +actively seeking collaborations and opportunities to help build +resilient trust infrastructure for digital preservation. + +
diff --git a/content/summit2026/talks/git-ratchet.md b/content/summit2026/talks/git-ratchet.md index d673270..6efe5b7 100644 --- a/content/summit2026/talks/git-ratchet.md +++ b/content/summit2026/talks/git-ratchet.md @@ -1,9 +1,9 @@ --- -url: summit2026/talks/git-ratchet.html +url: summit2026/talks/git-ratchet layout: summittalk title: "Git-ratchet: tooling for Git commit transparency" topImage: -type: +type: lightning room: start: speaker: Ben Birt diff --git a/content/summit2026/talks/le-mtcs.md b/content/summit2026/talks/le-mtcs.md index b88ae70..d1670c2 100644 --- a/content/summit2026/talks/le-mtcs.md +++ b/content/summit2026/talks/le-mtcs.md @@ -1,5 +1,5 @@ --- -url: summit2026/talks/le-mtcs.html +url: summit2026/talks/le-mtcs layout: summittalk title: "How Let's Encrypt is deploying Merkle Tree Certificates" topImage: diff --git a/content/summit2026/talks/sigstore.md b/content/summit2026/talks/sigstore.md index 0db233d..af4f137 100644 --- a/content/summit2026/talks/sigstore.md +++ b/content/summit2026/talks/sigstore.md @@ -1,5 +1,5 @@ --- -url: summit2026/talks/sigstore.html +url: summit2026/talks/sigstore layout: summittalk title: "Simplicity through Transparency: How the PQC Migration is Streamlining Sigstore" topImage: diff --git a/content/summit2026/talks/sostenuto.md b/content/summit2026/talks/sostenuto.md new file mode 100644 index 0000000..ef3c5d5 --- /dev/null +++ b/content/summit2026/talks/sostenuto.md @@ -0,0 +1,86 @@ +--- +url: summit2026/talks/sostenuto +layout: summittalk +title: "Sostenuto: Scaling & Sustaining Android Binary Transparency" +topImage: +type: +room: +start: +speaker: Billy Lau +speakerTitle: +--- + +
+ +Since its inception, Android Binary Transparency (ABT) has served as a +foundational security primitive for the Android ecosystem. While our effort +began by tackling transparency at the firmware level (characterized by +low-cadence monolithic OS builds and manually curated log entries), +extending these guarantees to the application layer (building on our +previous work presented in [Crescendo](https://www.youtube.com/watch?v=TZMspOgnr_A)) +introduces distinct onerational requirements, such as high-volume input +processing and data integrity. Unlike OS images, apps have continuous release +cadences, multi-variant delivery formats, and widespread deployment footprints. + +In this talk, we discuss [Google Product Application Transparency](https://developers.google.com/android/binary_transparency/google_apk/overview) +(GPAT) and [Android Mainline Modules Transparency](https://developers.google.com/android/binary_transparency/mainline_modules/overview) +(modular OS components delivered via app update channels), extending +cryptographic transparency guarantees to standalone product applications +and OS modules. Logging continuous-release applications such as Google Play +Services (com.google.android.gms) and YouTube (com.google.android.youtube) +differs substantially from firmware logging: release cadences shift from +monthly to continuous, and binary releases involve multidimensional variant +matrices (varying across ABIs, screen densities, and dynamic feature +splits). Consequently, a single logical version does not yield a single +binary hash; it produces a combinatorial explosion of split binaries that +must all be mapped, deduplicated, and verified without corrupting the log's +state. + +To address these requirements, we designed and built TLUaaS (Transparency +Log Updater as a Service), a backend ingestion and orchestration pipeline +engineered for large-scale log writing. We will discuss the design +decisions, failure modes, and operational lessons learned from running +TLUaaS in production, including: + +- Variant Resolution and Pre-Ingestion Deduplication: How TLUaaS computes +document deltas across continuous release streams, resolves multi-APK +variant sets, and deterministically normalizes binaries before committing +irreversible writes to the log. +- Production Safeguards and Ingestion Containment: Managing ingestion +pipelines where source metadata (including app signing keys, true release +manifests, and distribution streams) only exists in production environments +restricts our ability to perform pre-production testing. Because synthetic +data cannot account for real-world production variability, we will cover +the operational safeguards developed to mitigate bad-data ingestion, such +as emergency containment fail-safes for test packages and strict +server-targeting controls. + +To illustrate end-to-end verification, we will demonstrate [Uraniborg](https://github.com/android/android-binary-transparency/tree/main/uraniborg), +an open-source audit tool used to scan on-device APKs and verify them +against published transparency logs and cryptographic proofs. Attendees +will leave with practical design patterns for operating immutable +transparency logs that take input from multiple pipelines at scale, +techniques for handling variant-heavy release pipelines, and strategies for +maintaining data integrity in supply-chain verification systems. + +--- + +### Speaker + +Billy Lau is a security engineer in the Android Security team. He is +primarily interested in information security, with emphasis on operating +systems and user applications. In recent years, he has been trying to +leverage transparency constructs into the Android OS and influence the +larger ecosystem for the further protection of users. He has been examining +various security designs for mobile devices and analyzing the security and +privacy impacts of mobile computing devices in everyday life. He +particularly loves to challenge the status quo on conventional security +assumptions, which are often broken when put to test. He aspires to push +the scientific envelope in mobile security and to make Android the most +secure consumer operating system by identifying and solving the deepest +problems in the realm of mobile security and leveraging his position in the +industry to make mobile computing more reliable and secure. In general, he +hopes to make a difference by making usable computer systems more secure +and secure systems more usable. + +
diff --git a/content/summit2026/talks/tkey.md b/content/summit2026/talks/tkey.md new file mode 100644 index 0000000..c908c7e --- /dev/null +++ b/content/summit2026/talks/tkey.md @@ -0,0 +1,67 @@ +--- +url: summit2026/talks/tkey +layout: summittalk +title: "The TKey sign-if-logged tool" +topImage: +type: +room: +start: +speaker: Niels Möller +speakerTitle: +--- + +
+ +The Sigsum transparency system enables detection of unexpected or +malicious use of a signing key. The owner of a signing key submits +each signature made to a Sigsum log, and gets back a corresponding +Sigsum proof of logging. The parties that rely on these signatures +(e.g., for installing signed software updates) are expected to reject +any signature that does not come with a valid proof of logging. The +key owner can then monitor the log and discover all signatures made +that are going to be accepted. + +Discoverability of signatures is a desirable property, but what if you +are making signatures in a context where those relying on your +signatures are unable to process a Sigsum proof? E.g., the signature +may have to follow some standard that's not easily extended with a +Sigsum proof, or the signatures have to be verified on a slow embedded +system where extended verification is impractical for performance +reasons. + +The Tillitis TKey is an open source USB hardware security device which +allows running small arbitrary applications in a more secure +environment, using measured boot to give each application its own +secret. Security keys and HSMs, including the TKey, are often used as +signing oracles. But we can do better, by having the device also +enforce Sigsum logging of the data before signing. + +The sign-if-logged tool consists of a host program, and a TKey device +app. The host program configures the device app with a Sigsum policy +and a list of authorized submitter keys. The host program can then ask +the device to sign data, but the device requires that the host also +provides a Sigsum proof, valid according to its configuration. + +This way, the signing party gets discoverability of signatures, and +the ability to detect unexpected or malicious key usage, without the +parties relying on those signatures having to know about it. + +The talk will give a brief introduction to Sigsum and the TKey +hardware. It will explain how the sign-if-logged tool works and how to +use it. If time permits, it will also introduce the Sigsum C library, +which is designed with constrained embedded systems in mind. + +A version 1.0.0 of the sign-if-logged tool was released this summer. + +Source code and documentation: +https://git.glasklar.is/sigsum/apps/sign-if-logged + +--- + +### Speaker + +Working with the Sigsum project at Glasklar Teknik since 2022. Main +author and maintainer of the GNU Nettle crypto library. PhD from the +Automatic Control group at KTH. + +