Building cryptographic agility into Sigstore

Summary: Trail of Bits worked with the Sigstore community over two years to replace Sigstore's hard-coded ECDSA P-256 and SHA-256 with a centralized algorithm registry in the Protobuf specifications, configurable algorithm restrictions in Rekor and Fulcio, and a --signing-algorithm flag in Cosign. The design uses predefined algorithm suites such as PKIX_ECDSA_P256_SHA_256 and selects them out-of-band through configuration or policy, avoiding the in-band signaling behind the JWT alg:none and RSA/HMAC confusion attacks, and the team built Go implementations of post-quantum algorithms LMS and ML-DSA to show the architecture can take new standards.
Why it matters: Signatures made today may need to stay verifiable for 20 years while the cryptography behind them may fail within 10, and the JWT alg:none flaw shows how quickly algorithm flexibility becomes a forgery path when the signed data picks its own algorithm.

Read the original at Trail of Bits Blog ↗