Abstract: Techniques for preventing leakage of sensitive information through a signature are disclosed. Data is received, and the data is transmitted to a signature and encryption (SE) service, along with an encryption key. Signed and encrypted data is received from the SE service, where the signed and encrypted data is (i) encrypted using the encryption key and (ii) signed by the SE service. A verification is performed to verify that that sensitive information (such as the encryption key) is not leaked through a side channel of a signature of the signed and encrypted data, such as by (i) determining a length of the side channel of the signature, and (ii) verifying that the length of the side channel of the signature does not exceed a threshold length. Responsive to verifying that the sensitive information is not leaked through the side channel of the signature, the signed and encrypted data is transmitted.

Abstract: Techniques for preventing leakage of sensitive information through a signature are disclosed. Data is received, and the data is transmitted to a signature and encryption (SE) service, along with an encryption key. Signed and encrypted data is received from the SE service, where the signed and encrypted data is (i) encrypted using the encryption key and (ii) signed by the SE service. A verification is performed to verify that that sensitive information (such as the encryption key) is not leaked through a side channel of a signature of the signed and encrypted data, such as by (i) determining a length of the side channel of the signature, and (ii) verifying that the length of the side channel of the signature does not exceed a threshold length. Responsive to verifying that the sensitive information is not leaked through the side channel of the signature, the signed and encrypted data is transmitted.

Abstract: Techniques for selective passage of software packages to a deployment tenancy, based on a signed software bill of materials (SBOM), are described. A SBOM, which is generated for a first software package, is received, wherein the first software package is built from a source code. An analysis is performed on (i) the SBOM, (ii) at least first one or more sections of the source code, and/or (iii) an intermediate representation of at least second one or more sections of the source code. Responsive on passing the analysis, the SBOM is digitally signed to generate a signed SBOM. A second software package is received. A verification is performed as to whether the signed SBOM corresponds to the second software package. Responsive at least in part on a verification that the signed SBOM corresponds to the second software package, passage of the second software package to a deployment tenancy is allowed.

Abstract: Techniques for transmitting data within a cloud environment are disclosed. Data is received by a transmission service, which transmits the data to a signature and encryption (SE) service, along with an encryption key. Signed and encrypted data, which is received from the SE service, is (i) encrypted using the encryption key and (ii) signed by the SE service. In an example, the SE service maintains a log of the data. The signed and encrypted data is transmitted to an intermediate zone, to facilitate the intermediate zone to verify a signature of the signed and encrypted data, and allow passage of the signed and encrypted data to a reception service. The transmission and reception services are within a first tenancy and a second tenancy, respectively, of a cloud environment; and the intermediate zone is within one of the first tenancy or a third tenancy of the cloud environment.

Abstract: Techniques for preventing leakage of sensitive information through a signature are disclosed. Data is received, and the data is transmitted to a signature and encryption (SE) service, along with an encryption key. Signed and encrypted data is received from the SE service, where the signed and encrypted data is (i) encrypted using the encryption key and (ii) signed by the SE service. A verification is performed to verify that that sensitive information (such as the encryption key) is not leaked through a side channel of a signature of the signed and encrypted data, such as by (i) determining a length of the side channel of the signature, and (ii) verifying that the length of the side channel of the signature does not exceed a threshold length. Responsive to verifying that the sensitive information is not leaked through the side channel of the signature, the signed and encrypted data is transmitted.