Freeze attacks

A freeze attacker does not need to forge a package. It can keep returning the same previously valid repository state so a device never learns that a security update exists.

TUF timestamp metadata has a short expiry. Once expired, the device refuses to treat that repository view as current. Snapshot metadata then binds the exact version set below it. This turns indefinite silent replay into a visible update failure that operators can investigate.

Expiry depends on a sufficiently correct device clock and the device reaching a source of fresh metadata. Fully disconnected operation therefore needs a deliberate offline metadata refresh ceremony. TUF can expose stale state; it cannot create connectivity or trusted time.

See Offline and air-gapped operation and TUF threat model.