OWASP / OWASP/pytm

Nested trust boundaries

Open
#271 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
1.2k
Forks
229
PR merge metrics
No merged PRs in 30d

Description

Is it possible to put same asset in two boundaries? For example:

I am building a threat model for how devices secrets are saved multiple ways. I have device trust boundary but within that device some assets should be placed in separate boundaries like eHSM which exist in same device but have separate trust level. I want to showcase this in nested trust boundary way.

thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Start by tracing the Python APIs for assets and trust boundaries, then inspect existing examples or tests for boundary relationships. Done means establishing whether an asset can belong to nested boundaries and, if unsupported, defining the required behavior with coverage for the eHSM-in-device case.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.