Skip to content

Keyless Signing

Keyless Signing with Cosign

Keyless signing with Cosign is a cryptographic workflow that eliminates the need to manage private keys directly on the signing machine while maintaining the integrity and authenticity of container images. Instead of storing private keys locally, this approach leverages a trusted public key infrastructure (PKI) and secure key management systems (KMS) to sign images. The private key is never exposed to the signing process, reducing the risk of key compromise and simplifying operational overhead.

Workflow Overview

  1. Certificate Chain Setup:
    A certificate signed by a trusted root certificate is generated. This certificate contains the public key used to verify the signature. The root certificate must be trusted by all systems that validate the image.

  2. Secure Key Storage:
    The private key corresponding to the certificate is stored in a secure key management system (KMS) or hardware security module (HSM). This ensures the private key is never exposed to the signing machine.

  3. Image Signing:
    Cosign interacts with the KMS/HSM to sign the container image. The signing process uses the private key stored securely, while the public key from the certificate is embedded in the image metadata.

  4. Verification:
    During image distribution, Cosign verifies the signature by checking the certificate chain against trusted roots. This ensures the image has not been tampered with and originates from a trusted source.

Components Involved

  • Certificate: A public key certificate signed by a trusted root.
  • KMS/HSM: Secure storage for the private key, enabling cryptographic operations without exposing the key.
  • Cosign: The tool that orchestrates signing and verification, leveraging the KMS/HSM for secure signing.

Example Commands

1. Generate a Certificate (Using OpenSSL)

openssl req -newkey rsa:2048 -nodes -keyout private.key -out certificate.cer -days 365
This creates a self-signed certificate (certificate.cer) and a private key (private.key). The certificate must be signed by a trusted root in production environments.

2. Configure KMS/HSM Access

Each KMS (e.g., AWS KMS, Azure Key Vault, HashiCorp Vault) requires specific configuration. For example, AWS KMS might involve setting up IAM roles and permissions:

aws kms import-key-material --key-id <key-id> --encrypted-key-blob <base64-encoded-key>

3. Sign an Image with Cosign

cosign sign --key <path-to-certificate> <image-name>
Cosign uses the certificate's public key to attach the signature to the image. The private key remains securely stored in the KMS/HSM.

4. Verify the Signature

cosign verify <image-name>
Cosign checks the certificate chain against trusted roots, ensuring the signature is valid and the image is unaltered.

Security Considerations

  • Private Key Isolation: The private key is never exposed to the signing machine, reducing the attack surface.
  • Trusted Root Management: The root certificate must be securely distributed and revoked if compromised.
  • KMS/HSM Security: The KMS/HSM must be configured with strong access controls and audit logging.
  • Certificate Rotation: Regularly update certificates to mitigate risks from expired or compromised keys.

Diagram: Keyless Signing Workflow

[Trusted Root Certificate]  
         |
         v
[Certificate with Public Key]  
         |
         v
[Image with Embedded Signature]  
         |
         v
[Verification via Cosign]  
         |
         v
[Trusted Root Validation]

Key takeaways

  • Keyless signing eliminates the need to manage private keys on the signing machine, reducing security risks.
  • Cosign leverages PKI and secure KMS/HSM integration to sign and verify container images.
  • The workflow ensures cryptographic integrity without exposing private keys to the signing process.
  • Trust in the certificate chain and secure KMS/HSM configuration are critical for operational reliability.
  • This approach simplifies compliance and operational overhead in multi-cloud environments.