Key access permission verification #4

New Issue

hatter · 2024-09-04T23:52:01+08:00

hatter commented

2024-09-04 23:52:01 +08:00

Add access processor permission

Same PID+Command+Exec will be cached
Check process signature, signed with EC P256 or P384
Cli access can assign short term access ticket

Signature file:
<command>.sig

*.sig format:

{
  "file": "file-name.ext",
  "digest": "sha256-XXXXXXXXXXXXXXXXXXXXX",
  "signature": "<hex signature>"
}

file is optional
digest should starts with sha256- or sha-384-

Signature format:

ecdsa:XXXXXXXXXXX, or
hmac:<hex nonce>:XXXX-of-HMAC

ecdsa means SHA256withSHA256
hmac means HmacSHA256

Where:

XXXX-of-HMAC = Hex(HmacSha256(Concat(<nonce in bytes>, <digest value in bytes>), MasterKey))

Add access processor permission 1. Same PID+Command+Exec will be cached 2. Check process signature, signed with EC P256 or P384 3. Cli access can assign short term access ticket Signature file: `<command>.sig` `*.sig` format: ```json { "file": "file-name.ext", "digest": "sha256-XXXXXXXXXXXXXXXXXXXXX", "signature": "<hex signature>" } ``` `file` is optional `digest` should starts with `sha256-` or `sha-384-` Signature format: - `ecdsa:XXXXXXXXXXX`, or - `hmac:<hex nonce>:XXXX-of-HMAC` <br> - `ecdsa` means `SHA256withSHA256` - `hmac` means `HmacSHA256` Where: ``` XXXX-of-HMAC = Hex(HmacSha256(Concat(<nonce in bytes>, <digest value in bytes>), MasterKey)) ```

hatter added the Kind/Feature Kind/Security

Priority

Medium

labels 2024-09-04 23:52:01 +08:00

hatter self-assigned this 2024-09-04 23:52:01 +08:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hatter/local-mini-kms#4