BUILDING CRYPTOGRAPHIC AGILITY INTO SIGSTORE

Summary from the TLDR InfoSec newsletter

Trail of Bits collaborated with the Sigstore community to implement controlled cryptographic flexibility through predefined algorithm suites, avoiding the in-band signaling vulnerabilities that plagued systems like JWT while enabling organizations to select signing algorithms beyond the original hard-coded ECDSA P-256. The implementation includes a centralized algorithm registry in Protobuf specifications, configurable algorithm restrictions via --client-signing-algorithms flags in Rekor and Fulcio, and a new --signing-algorithm option in Cosign for ephemeral key generation. Go implementations of post-quantum algorithms, LMS, and ML-DSA were developed to validate that the architecture can accommodate future cryptographic standards.