Signer-less Device Pairing #281

nepet · 2023-10-01T23:55:56Z

This PR adds the "Pairing Process/Protocol" to the client stack. The Pairing-Process is a way to connect a signer-less client to a greenlight node. The pairing request has to be approved by a trusted device.

I'll add a more details about the process soon.

Randy808 · 2024-05-22T17:20:14Z

libs/gl-client/src/pairing/service.rs

Is this an old iteration of attestation_device.rs?

Randy808 · 2024-05-22T18:24:31Z

libs/gl-client/src/pairing/attestation_device.rs

+
+pub struct Client<T> {
+    inner: T,
+    tls: TlsConfig,


Any strong objections to replacing tls, rune, and key with creds?

It would make the definition of the Client smaller and allows us to skip passing the node_id to approve_pairing

Randy808 · 2024-05-22T18:48:00Z

libs/gl-client/src/pairing/attestation_device.rs

+        session_id: &str,
+        node_id: &[u8],
+        device_name: &str,
+        restrs: &str,


Can the restrictions argument here be dropped?

If we allow the attestation device to put whatever restrictions they want, the application requesting the pairing may too little access to fulfill their use-case. Can we make it like android permissions where the base permissions are all or nothing? A gl-client consumer can show the user the restrictions put on the app with the pairing request when they receive it in get_pairing_data. ~~Then the pairing can be completed from the restrictions from the original pairing request on the server-side~~.

Also, what do you think about letting the attestation device reject the pairing request? I'm thinking it might be helpful for the requesting application on the UX side if the user doesn't like the proposed restrictions

Edit: Removed the part about completing the pairing using restrictions saved by the server. As discussed, there would be no way for the server to tack-on restrictions to the message sent to the signer_requests_stream connection since it expects the client's tls keypair to cover the data. And because requiring a signature (from the requester of the new_device) for verification in the attestation device's signer is probably not a good idea.

Randy808 · 2024-05-22T18:50:29Z

libs/gl-client/src/pairing/attestation_device.rs

+        &self,
+        session_id: &str,
+        node_id: &[u8],
+        device_name: &str,


Can we make the device_name optional?

Randy808 · 2024-05-22T18:59:41Z

libs/gl-client/src/signer/mod.rs

+    ) -> () {
+        let mut data = vec![];
+        data.put(req.session_id.as_bytes());
+        data.put_u64(req.timestamp);


Should the timestamp be checked in this method to bound its staleness like what was mentioned in the comment here?:

https://github.com/Blockstream/greenlight/pull/281/files#diff-95a68fef05d112753f7fbc0859cb6df74b6df1b75994ceb8937170b228651c88R515

Randy808 · 2024-05-22T19:06:05Z

libs/gl-client/src/signer/mod.rs

+        let mut data = vec![];
+        data.put(req.session_id.as_bytes());
+        data.put_u64(req.timestamp);
+        data.put(&req.node_id[..]);


Could we pull the node_id from self here?

Randy808 · 2024-05-22T19:29:31Z

libs/gl-client/src/pairing/new_device.rs

+impl Client<Unconnected> {
+    pub fn new<T>(creds: T) -> Client<Unconnected>
+    where
+        T: TlsConfigProvider,


Should we return an error if device_creds are passed in? Or are we allowing a pairing to be scoped to a greenlight node?

We need to create a keypair before we can actually create the cert during the pairing process. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

This commit only affects the protos, generated files and places that include the protos. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

This implements the service and the methods to initialize a pairing session on the "new device" Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

Adds the PairingQR proto message and pass it to the channel once we did the request. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

Adds a method that returns the relevant data for "old device" to approve a pairing. This includes the requested restrictions that an old device needs to sign off. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

Adds the approval of the old device. This does not check the signature and does also not check the restrictions. This soley approves the pairing request. This needs a tls cert and a rune to be present as we need these to sign and attestate the approval. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

This adds a method to the pairing service that allows to check the validity of the PairingDataResponse. This is that the public key from the session_id matches the public key from the CSR. We may want to add a signature for the restrictions to ensure that GL did not manipulate them. We are OK for now as a user has to aggree to the restrictions anyway. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

This is preperatory to set up the scheduler -> signer stream. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

Signer now receives requests from the scheduler for further processing. The signer processes a ApprovePairingRequest and responds to the scheduler. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

This commit replaces TlsConfig dependencies introduced by the signerless device pairing with Credentials. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

Randy808 · 2024-06-12T22:12:41Z

libs/gl-client/.resources/proto/glclient/scheduler.proto

+	uint64 timestamp = 2;
+
+	// The id of the node to pair with.
+	bytes node_id = 3;


Can we remove this since it looks like it's pulled from the cert on the server side?

Randy808 · 2024-06-12T23:57:11Z

libs/gl-client/src/signer/mod.rs

+        match self.verify_rune(PendingRequest {
+            request: vec![],
+            uri: "/cln.Node/ApprovePairing".to_string(),
+            signature: req.sig,


Does the Context need to be updated to handle the signature?

greenlight/libs/gl-client/src/runes.rs

Line 159 in e38a376

pub struct Context {

nepet force-pushed the 202309-pairing-protocol branch from 41335cf to 4050841 Compare October 2, 2023 12:56

nepet force-pushed the main-0.2 branch 2 times, most recently from 92251ee to 981db7e Compare October 9, 2023 15:55

nepet force-pushed the main-0.2 branch 2 times, most recently from 8b5a797 to 40c5809 Compare November 5, 2023 19:52

nepet force-pushed the 202309-pairing-protocol branch from 4050841 to 8fb8916 Compare November 7, 2023 12:50

nepet force-pushed the main-0.2 branch from 40c5809 to a90ecb4 Compare November 10, 2023 16:02

nepet force-pushed the 202309-pairing-protocol branch from 8fb8916 to 5c485cd Compare November 10, 2023 16:06

nepet force-pushed the main-0.2 branch 2 times, most recently from ad9d0b4 to 180bb26 Compare November 26, 2023 13:24

nepet force-pushed the 202309-pairing-protocol branch 2 times, most recently from e0db8e2 to 157a322 Compare December 1, 2023 11:37

nepet force-pushed the 202309-pairing-protocol branch from 157a322 to ed1aed8 Compare December 3, 2023 17:12

cdecker force-pushed the main-0.2 branch from c728bd7 to 06f8b10 Compare December 12, 2023 11:02

nepet force-pushed the 202309-pairing-protocol branch from 3194f42 to 2d46078 Compare December 12, 2023 12:46

cdecker force-pushed the main-0.2 branch from 06f8b10 to b6517b2 Compare January 8, 2024 10:52

nepet force-pushed the main-0.2 branch from b6517b2 to 9a193b1 Compare January 10, 2024 07:34

nepet force-pushed the 202309-pairing-protocol branch from 2d46078 to 9cec7a5 Compare January 10, 2024 07:34

nepet force-pushed the main-0.2 branch from 9a193b1 to 64fd6e1 Compare January 10, 2024 19:57

nepet force-pushed the 202309-pairing-protocol branch from 9cec7a5 to 06d40ab Compare January 10, 2024 19:58

nepet force-pushed the main-0.2 branch from 64fd6e1 to 6d16a7d Compare January 11, 2024 16:08

nepet force-pushed the 202309-pairing-protocol branch from 06d40ab to 6265146 Compare January 11, 2024 16:08

nepet force-pushed the main-0.2 branch 3 times, most recently from 644185e to d010f8d Compare February 2, 2024 18:36

nepet force-pushed the main-0.2 branch 5 times, most recently from f2b305e to f504032 Compare February 9, 2024 01:50

Base automatically changed from main-0.2 to main March 6, 2024 17:01

nepet force-pushed the 202309-pairing-protocol branch 3 times, most recently from d0f25a9 to 53d054e Compare May 20, 2024 20:59

nepet requested review from cdecker and Randy808 May 20, 2024 21:26

Randy808 reviewed May 22, 2024

View reviewed changes

libs/gl-client/src/pairing/service.rs Outdated

Copy link

Collaborator

Randy808 May 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this an old iteration of attestation_device.rs?

Randy808 reviewed May 22, 2024

View reviewed changes

nepet force-pushed the 202309-pairing-protocol branch from 53d054e to dd15fc9 Compare May 23, 2024 12:52

nepet force-pushed the 202309-pairing-protocol branch 3 times, most recently from eefc7d3 to 5021f5b Compare June 2, 2024 22:48

nepet added 10 commits June 11, 2024 08:22

tls: Add function to generate cert from keypair

bda4dc6

We need to create a keypair before we can actually create the cert during the pairing process. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

proto: Add Pairing Service to the scheduler

975f75b

This commit only affects the protos, generated files and places that include the protos. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

pairing: Add client side pairing session init

24764bc

This implements the service and the methods to initialize a pairing session on the "new device" Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

pairing: Add QR code data to the pairing process

4561b08

Adds the PairingQR proto message and pass it to the channel once we did the request. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

pairing: Add grpc method to get session data

8eec210

Adds a method that returns the relevant data for "old device" to approve a pairing. This includes the requested restrictions that an old device needs to sign off. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

signer: Move hsmd stream out of run_once

21e890c

This is preperatory to set up the scheduler -> signer stream. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

pairing: Attach signer to the pairing process

a4648ca

Signer now receives requests from the scheduler for further processing. The signer processes a ApprovePairingRequest and responds to the scheduler. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

pairing: Replace TlsConfig

613af99

This commit replaces TlsConfig dependencies introduced by the signerless device pairing with Credentials. Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>

nepet force-pushed the 202309-pairing-protocol branch from 5021f5b to 613af99 Compare June 12, 2024 11:26

Randy808 reviewed Jun 12, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Signer-less Device Pairing #281

Signer-less Device Pairing #281

nepet commented Oct 1, 2023 •

edited

Randy808 May 22, 2024

Randy808 May 22, 2024

Randy808 May 22, 2024 •

edited

Randy808 May 22, 2024

Randy808 May 22, 2024 •

edited

Randy808 May 22, 2024

Randy808 May 22, 2024 •

edited

Randy808 Jun 12, 2024

Randy808 Jun 12, 2024

Signer-less Device Pairing #281

Are you sure you want to change the base?

Signer-less Device Pairing #281

Conversation

nepet commented Oct 1, 2023 • edited

Randy808 May 22, 2024

Choose a reason for hiding this comment

Randy808 May 22, 2024

Choose a reason for hiding this comment

Randy808 May 22, 2024 • edited

Choose a reason for hiding this comment

Randy808 May 22, 2024

Choose a reason for hiding this comment

Randy808 May 22, 2024 • edited

Choose a reason for hiding this comment

Randy808 May 22, 2024

Choose a reason for hiding this comment

Randy808 May 22, 2024 • edited

Choose a reason for hiding this comment

Randy808 Jun 12, 2024

Choose a reason for hiding this comment

Randy808 Jun 12, 2024

Choose a reason for hiding this comment

nepet commented Oct 1, 2023 •

edited

Randy808 May 22, 2024 •

edited

Randy808 May 22, 2024 •

edited

Randy808 May 22, 2024 •

edited