Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add functionality for external signatures #2

Merged
merged 3 commits into from
Jan 27, 2021
Merged

Add functionality for external signatures #2

merged 3 commits into from
Jan 27, 2021

Commits on Jan 27, 2021

  1. Add functionality for auth generation with signed data instead of pri… 

    …vate key

Previously, if a user wanted to make a signed auth file, they would need to supply secvarctl with public and private key pairs for signing the data. Recently, it has come to our attention that some users will not have access to their private keys as it may be under the guard of a signing framework server. In this case, the most secvarctl can do is to generate the hash to be signed. From their, it is up to the user to generate the signature with their signing framework. Then the user can give secvarctl the signature and the generation of PKCS7/auth files can resume. It is important the user uses the same timestamp in both the presignature generation and auth/PKCS7 generation. Now, with this commit, the user can use a signing framework to generate an auth file using the below commands:
    - $ secvarctl generate c:x -n <varName> -t <timeStamp> -i <certificate> -o <sha256.hash>
    - $ <user sends hash to be signed -in <sha256.hash> -out <signature.bin>
    - $ secvarctl generate c:a -n <varName> <timeStamp> -i <certificate> -o <newAuth> -c <signingCert> -s <signature.bin>
    @nick-child-ibm
    nick-child-ibm committed Jan 27, 2021
    Configuration menu
    Copy the full SHA
    7d12184 View commit details
    Browse the repository at this point in the history

  2. Documentation: Update documentation for external signing funcitonality 

    In the previous commit, abilities to create auth and PKCS7 files with a raw signed data files in replacement of private key arguments was introduced. This commit adds those changes to the documentation and help messages
    @nick-child-ibm
    nick-child-ibm committed Jan 27, 2021
    Configuration menu
    Copy the full SHA
    f2ee1b9 View commit details
    Browse the repository at this point in the history

  3. runSvcGenerateTests.py: Add tests for external signature 

    In the two previus commits, documentation and functionality were added to allow for secvarctl to accept an external signature rather than generating the signature internally. Now, we add tests to ensure that the enhanement was executed appropriately. To test we generate a signed auth file to work as our control. Then we generate an unsigned hash digest and sign it externally with openssl. We then use the signature to generate another signed auth file that will be our experiment. If the control and experiment contain the exact same data then the test passes.
    @nick-child-ibm
    nick-child-ibm committed Jan 27, 2021
    Configuration menu
    Copy the full SHA
    395e49b View commit details
    Browse the repository at this point in the history