Towards Zero-Knowledge Software Bill of Materials

Abstract

The growing importance of software supply chain security has revealed the critical need for securely sharing Software Bills of Materials (SBOMs). SBOMs enhance transparency by providing a detailed inventory of software components, but can inadvertently expose sensitive proprietary information and vulnerabilities when shared publicly. Addressing this challenge, this thesis explores the use of cryptographic techniques to achieve privacy-preserving and verifiable SBOM sharing. This thesis addresses this challenge by proposing zkSBOM (Zero-Knowledge Software Bill of Materials), a proof-of-concept system for privacy-preserving and verifiable SBOM sharing. It explores the system requirements and design for achieving secure yet transparent SBOM sharing, the effectiveness of various cryptographic techniques in safeguarding sensitive SBOM information, and the integration with real-world SBOMs. Through system design analysis and an experimental approach, this work provides solid insights into privacy-enhanced SBOM-sharing. The results demonstrate that the use of established cryptographic techniques is suitable to securely share SBOMs in real-world scenarios. We propose a centralised system enabling software vendors to upload their SBOMs and allowing verifiers to query for vulnerabilities. Additionally, we offer a local verifier system that allows verifiers to independently validate the proofs generated by the centralised system. The system leverages cryptographic techniques such as Merkle Trees, Sparse Merkle Trees, Merkle Patricia Tries, and Zero-Knowledge Sets. Using them, zkSBOM enables selective disclosure of SBOM information efficiently. The system ensures transparency through verifiable inclusion and non-inclusion proofs while safeguarding critical information. In a case study, we successfully ingest 16 out of 18 SBOMs and generate inclusion proofs for dependencies affected by a given vulnerability. This research contributes to advancing privacy-preserving SBOM sharing, paving the way for broader adoption in the software industry while strengthening the security of software supply chains.