SAE Authorization

SAE authorization details

The basics (registry file, client CA trust) are in the README.

Key issuance and retrieval rules

Any mapped SAE can request a key for any registered SAE. On enc_keys, the master is the certificate's SAE and the slave is the SAE in the URL. Both codes are encrypted in the returned UUID. On dec_keys, the server decrypts the ID; the caller must match its slave code, and the URL's master SAE must match its master code. The entire batch is rejected with 401 if any ID belongs to another pair. This also prevents the master from retrieving its own issued key through dec_keys, unless master and slave are explicitly the same SAE. Request-SAE-ID cannot impersonate another SAE. There is no additional pair allowlist.

Certificate mapping rules

For saved configurations, cert inspect FILE prints numbered selectors and sae add ID --code N --cert FILE --selector N registers one. Use sae list and sae remove ID to manage entries; omit --cert for remote-only SAEs. Keep the same stable numeric codes at both endpoints. The inspector and selector extraction do not establish certificate trust. See Standalone provisioning.

cert inspect prints metadata only and does not verify trust. Each numbered Selector line is an inline table that can be pasted into an identities = [...] list of an [[sae]] entry in the registry file:

qkd-stub cert inspect path/to/client.crt

Supported selector fields are subject_dn, san_dns, san_uri, san_email, and san_ip. DN, URI, and email matching is exact and case-sensitive. DNS matching is ASCII case-insensitive; IP addresses are normalized. There are no wildcard, substring, or regex matches. DN values use a deterministic RFC4514-style rendering with escaped attribute values; use inspector output rather than hand-translating another tool's DN formatting. Unsupported non-UTF8 DN attributes require a SAN selector. Other SAN types are ignored.

Multiple selectors are alternatives. A certificate may match several selectors for the same SAE, but matching different SAEs is an error; there is no DN/SAN precedence. Duplicate IDs, numeric codes, selectors, and invalid configuration fields are rejected at startup. Client certificate renewal works without changing key IDs when the replacement certificate maps to the same SAE code.