Navigating Supply Chain Security: In-toto vs. SLSA

In-toto and SLSA (Supply-chain Levels for Software Artifacts) are both frameworks designed to ensure software supply chain security, but they tackle the problem in different ways and with varying scopes.

In-toto

Purpose:

In-toto is a framework designed to secure the entire software supply chain by providing end-to-end security guarantees. It ensures that each step in the supply chain is cryptographically verified.

Features:

• Step Definitions: We define steps in the software development process (like code writing, testing, or building).

• Link Metadata: For each step, in-toto generates metadata, known as links, which include the materials (inputs), products (outputs), and the environment used.

• Layout: A layout file outlines the sequence of steps and identifies the functionaries responsible for each step.

• Verification: At the end of the supply chain, in-toto verifies that all steps were performed correctly according to the layout, ensuring no tampering occurred.

Usage:

In-toto is especially useful for developers and organizations that want to maintain tight control over their software supply chain, making sure every step is verifiable and secure.

SLSA (Supply-chain Levels for Software Artifacts)

Purpose:

SLSA is a security framework designed to protect against threats to the software supply chain by offering a set of security levels. It’s a prescriptive framework that aims to improve the security posture of software supply chains incrementally.

Features:

• Levels of Assurance: SLSA defines four levels of assurance, ranging from basic (Level 1) to the highest level of security (Level 4).

  • Level 1: Requires the build process to be fully scripted and automated.

  • Level 2: Adds requirements for build service that generates provenance.

  • Level 3: Requires a hardened build service and strong source control.

  • Level 4: Includes everything from Level 3, plus requirements for two-person reviews and hermetic builds.

• Provenance: SLSA emphasizes the generation and verification of provenance, which is metadata that describes the origin of a software artifact and how it was produced.

Usage:

SLSA is designed for a broad audience, including software producers and consumers who want to gradually improve the security of their software supply chains. It offers a roadmap for reaching higher security levels over time.

Key Differences

1. Scope and Granularity:

In-toto: Focuses on fine-grained control and verification of each step in the software supply chain, providing end-to-end security.

SLSA: Offers a broader, incremental approach to supply chain security with different levels of assurance that can be adopted over time.

2. Implementation Approach:

In-toto: Requires defining and verifying each step and its metadata in the supply chain, providing detailed tracking and verification.

SLSA: Focuses on improving the overall security posture with specific levels that outline requirements and best practices.

3. Flexibility:

In-toto: Offers more flexibility in defining custom steps and processes.

SLSA: More prescriptive, providing clear levels and guidelines that organizations can follow.

4. Use Case:

In-toto: Ideal for organizations that want comprehensive, detailed tracking and verification of their entire software supply chain.

SLSA: Ideal for organizations looking for a structured path to improve supply chain security incrementally.

Conclusion

Both In-toto and SLSA are valuable tools for securing the software supply chain, but they serve different needs and approaches. In-toto offers detailed, step-by-step verification, while SLSA provides a scalable framework with incremental levels of security assurance. Organizations can choose the framework that best fits their security requirements and operational capabilities.