Hi everyone,

Today we are launching Sigsum, a free and open source software project
that revolves around transparency logs and their applications.

While most other logging efforts focus on concrete data structures like
TLS certificates, sigsum logs are meant to be general building blocks
that support signed checksums and minimally required metadata. It is up
to the signer to determine what a checksum should represent.

For example, Mozilla's take on Binary Transparency [1] fits into the
intended use of sigsum logging.  By avoiding the Certificate
Transparency design, complexity can be reduced.  Sigsum logging has no
SCTs, complicated ASN.1 parsers, or reactive gossip-audit protocols.

Minimalism, distributed trust, and centralized log operations make up
our key pillars. These characteristics keep the attack surface small.
They also simplify usage, operations, and verification of sigsum logs.

To learn more about sigsum logging, please refer to our design and API
documentation [2, 3].  There is also a public prototype available [4].

Would you like to be part of the conversation?  We have open Jitsi
meetings on Tuesdays at 11:00 UTC.  Meeting minutes and linked pads are
persisted in our archive for transparency and future reference [5].

Asynchronous interactions take place on IRC, Matrix, and email.

Website: https://www.sigsum.org/
Source: https://git.sigsum.org/
Pads: https://pad.sigsum.org/

Email: https://lists.sigsum.org/
IRC: #sigsum @ OFTC.net
Matrix: #sigsum:matrix.org
Jitsi: https://meet.sigsum.org/

About Sigsum
---
Sigsum started out as one part of the System Transparency project [6].

Early drafts of the public log element can be traced back to 2019 [7].
More focused design iterations started in October, 2020 [8].  Mature
drafts of what is now sigsum logging was presented in Q2 of 2021 [9-11].

Links
---
1: https://wiki.mozilla.org/Security/Binary_Transparency
2: https://git.sigsum.org/sigsum/tree/doc/design.md
3: https://git.sigsum.org/sigsum/tree/doc/api.md
4: https://git.sigsum.org/sigsum-log-go/tree/README.md
5: https://git.sigsum.org/sigsum/tree/archive
6: https://git.sigsum.org/sigsum/tree/doc/history.md
7: https://mullvad.net/blog/2019/6/3/system-transparency-future/
8: https://github.com/system-transparency/stfe/commit/40250377da81864e9e502b803c0543c48e4a0615
9: https://web.archive.org/web/20210427203606/https://hopin.com/events/padsec
10: https://web.archive.org/web/20210603112144/https://swits.hotell.kau.se/AnnualSeminars/SWITS%202021/SWITS_2021/SWITS2021_Programme.htm
11: https://web.archive.org/web/20210923134324/https://swits.hotell.kau.se/AnnualSeminars/SWITS%202021/SWITS_2021/SWITS_2021_paper_17.pdf