Fifth Third release signing, end to end

The trust model of the Fifth Third Edition: an HSM in Frankfurt, a two-of-two ceremony, a signed manifest and a workspace app that verifies every install. This whitepaper is the reference for the Fifth Third security model.

1. Key hierarchy

Root key: 4096-bit RSA, generated 2024-01-12 in a Nitrokey HSM in a colocation rack at Hetzner Frankfurt. Signs the quarterly Fifth Third release keys. Cold-stored offline between ceremonies.

Fifth Third release key: 2048-bit RSA, generated fresh on the first Wednesday of each quarter. Signed by the root key. Used to sign every APK and every batch manifest within the quarter. Retired at the end of the quarter with a documented sunset schedule.

2. Signing ceremony

Two of the four editorial-team members hold the ceremony smart cards. Both are required to unlock the HSM. Every ceremony is recorded (audit-log only, not video), timestamped, and reviewed by the third editor before the batch ships.

3. Batch manifest

The batch manifest is the plain-text file described at /docs/batch-manifest-format. It lists every module, version, SHA-256 checksum and byte size. The manifest is signed with the Fifth Third release key and served at /security-whitepaper/manifest/<batch>.txt.

4. Workspace app verification

The workspace app pins the current Fifth Third release-key certificate. Before every install it fetches the batch manifest, verifies the signature and then verifies each downloaded APK against the manifest line. If either check fails the install is refused.

5. Rotation schedule

The Fifth Third release key rotates on the first Wednesday of each quarter. The workspace app pins both the current and the incoming certificates from four weeks before rotation to four weeks after. Enrolled devices update their trust store on the first sign-in after the rotation window closes.

6. Incident response

A suspected release-key compromise triggers an immediate rotation regardless of the quarterly schedule. The incident-response runbook is exercised twice a year on a scheduled drill. A post-mortem is published to the workspace email within thirty days of a real incident.

7. Third-party attestation

The signing infrastructure is audited annually by Cure53 GmbH. The most recent audit report is available under a mutual NDA on request to security@fifththirdstore.org.

8. Public certificate

The current Fifth Third release-key certificate is served at /security-whitepaper/current.pem in PEM format and mirrored at /security-whitepaper/current.der in DER format. The SHA-256 fingerprint is published on this page and updated on every rotation.

9. Vulnerability disclosure

Coordinated-disclosure programme: security@fifththirdstore.org, PGP key fingerprint published on this page. Ninety-day disclosure clock. Hall-of-fame for reporters who help us improve the Fifth Third security model.