Add intermediate CA implementation with KMS-backed signer #496

haydentherapper · 2022-03-31T01:57:10Z

This CA implementation will use an on-disk certificate chain and a
remote KMS signer to sign certificates. There is validation on server
startup that the provided chain matches the provided key.

I've also added a utility to generate the intermediate certificate by
calling GCP CA Service. This will be used to set up Fulcio.

This also refactors the code to add an intermediate CA struct that
implements the common methods. This makes it simple to add new
intermediate CA types, with each only needing to provide a method to
fetch a signer and certificate chain.

Updated sigstore/sigstore to pull in the latest change to compare public keys.

Tested with:
go run pkg/ca/intermediateca/fetch_ca_cert/fetch_ca_cert.go --kms-key="gcpkms://projects/<project>/locations/us-central1/keyRings/test-key-ring/cryptoKeys/ca-key/versions/1" --gcp-ca-parent="projects/<project>/locations/us-west1/caPools/<pool>" --output="chain.crt.pem"

go run main.go serve --port 5555 --ca kmsca --ct-log-url="" --kms-key="gcpkms://projects/<project>/locations/us-central1/keyRings/test-key-ring/cryptoKeys/ca-key/versions/1" --cert-chain-path="chain.crt.pem"

Made a call using a script based on the load testing tool, got back a certificate chain.

Signed-off-by: Hayden Blauzvern hblauzvern@google.com

Summary

Ticket Link

Fixes #489

Release Note

Added a KMS-backed intermediate CA implementation

haydentherapper · 2022-03-31T02:00:25Z

This is a good compromise between the various solutions. While an ephemeral key and certificate would be great, as discussed in #494, this doesn't work well with replicated instances. Moving to a KMS-backed signer gives us the ability to limit and audit signing key access. KMS will also enable us to have far more QPS than CA Service, and controlling the signer will let us implement embedded SCTs (PR coming right up!).

With this design, we'll issue intermediates for the same lifetime as the root. I'd like to include the intermediate in the TUF targets to ease client discovery. Also this simplifies the revocation story - If the KMS signer is compromised, we simply remove the intermediate certificate from the TUF target metadata and add a new one. This design also mitigates an issue with verify-blob not being able to find the intermediate cert for verification, since it will now be embedded with TUF.

haydentherapper · 2022-03-31T02:01:40Z

cc @nsmith5 (Can't add you as a reviewer for some reason)

haydentherapper · 2022-03-31T02:04:40Z

Will investigate failing test - It's not failing locally for me.

haydentherapper · 2022-03-31T02:05:35Z

One last remark: I haven't added tests for kmsca.go because this relies on sigstore/sigstore's KMS library, and there's no mocks or fakes for this.

codecov-commenter · 2022-03-31T17:30:28Z

Codecov Report

Merging #496 (72f22e6) into main (765a06a) will decrease coverage by 4.40%.
The diff coverage is 72.44%.

@@            Coverage Diff             @@
##             main     #496      +/-   ##
==========================================
- Coverage   47.97%   43.57%   -4.41%     
==========================================
  Files          14       18       +4     
  Lines        1063     1221     +158     
==========================================
+ Hits          510      532      +22     
- Misses        480      615     +135     
- Partials       73       74       +1

Impacted Files	Coverage Δ
pkg/ca/kmsca/kmsca.go	`48.00% <48.00%> (ø)`
pkg/ca/fileca/load.go	`68.96% <66.66%> (+0.83%)`	⬆️
pkg/ca/intermediateca/intermediateca.go	`80.95% <80.95%> (ø)`
pkg/ca/fileca/fileca.go	`46.87% <100.00%> (+11.02%)`	⬆️
pkg/api/client.go	`75.22% <0.00%> (-1.92%)`	⬇️
pkg/ca/x509ca/common.go	`3.53% <0.00%> (ø)`
pkg/ca/x509ca/x509ca.go	`0.00% <0.00%> (ø)`

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 765a06a...72f22e6. Read the comment docs.

haydentherapper · 2022-03-31T17:38:17Z

Failing test resolved, I switched to using a directory generated by the test library.

dlorenc · 2022-03-31T22:53:03Z

Nice work!

haydentherapper · 2022-04-01T04:56:23Z

Added tests for kmsca.go. Temporarily added a replace to my fork of sigstore/sigstore until sigstore/sigstore#361 is submitted.

cmd/app/serve.go

priyawadhwa · 2022-04-05T21:54:36Z

This looks great!

haydentherapper · 2022-04-06T15:06:03Z

PR should be ready to go!

nsmith5

Awesome! Really like the refactor into pkg/intermediateca

pkg/ca/intermediateca/fetch_ca_cert/fetch_ca_cert.go

pkg/ca/kmsca/kmsca.go

pkg/test/cert_utils.go

nsmith5

Awesome work :D Just a nit about Kms versus KMS, but otherwise LGTM

pkg/ca/kmsca/kmsca.go

haydentherapper · 2022-04-09T16:09:37Z

Thanks! PR should be good to go unless there's any other comments.

This CA implementation will use an on-disk certificate chain and a remote KMS signer to sign certificates. There is validation on server startup that the provided chain matches the provided key. I've also added a utility to generate the intermediate certificate by calling GCP CA Service. This will be used to set up Fulcio. This also refactors the code to add an intermediate CA struct that implements the common methods. This makes it simple to add new intermediate CA types, with each only needing to provide a method to fetch a signer and certificate chain. Signed-off-by: Hayden Blauzvern <hblauzvern@google.com>

haydentherapper requested a review from bobcallaway March 31, 2022 02:00

haydentherapper force-pushed the intermediate branch from 9f85490 to d13744d Compare March 31, 2022 17:26

haydentherapper force-pushed the intermediate branch from d13744d to 6d2e577 Compare April 1, 2022 04:54

haydentherapper force-pushed the intermediate branch 2 times, most recently from 93fe5f1 to cb422ed Compare April 1, 2022 16:28

haydentherapper commented Apr 5, 2022

View reviewed changes

cmd/app/serve.go Show resolved Hide resolved

cmd/app/serve.go Outdated Show resolved Hide resolved

cmd/app/serve.go Outdated Show resolved Hide resolved

haydentherapper force-pushed the intermediate branch from cb422ed to fb2f3de Compare April 5, 2022 20:13

haydentherapper force-pushed the intermediate branch from c52f4b5 to 3e509fd Compare April 6, 2022 15:04

nsmith5 reviewed Apr 6, 2022

View reviewed changes

pkg/ca/intermediateca/fetch_ca_cert/fetch_ca_cert.go Outdated Show resolved Hide resolved

pkg/ca/intermediateca/fetch_ca_cert/fetch_ca_cert.go Outdated Show resolved Hide resolved

pkg/ca/kmsca/kmsca.go Show resolved Hide resolved

pkg/test/cert_utils.go Outdated Show resolved Hide resolved

haydentherapper mentioned this pull request Apr 6, 2022

Embed SCTs in issued certificates #507

Merged

nsmith5 approved these changes Apr 8, 2022

View reviewed changes

pkg/ca/kmsca/kmsca.go Outdated Show resolved Hide resolved

dlorenc mentioned this pull request Apr 9, 2022

add changelog for v0.3.0 release #508

Merged

haydentherapper force-pushed the intermediate branch from 72f22e6 to 2504406 Compare April 9, 2022 16:09

haydentherapper force-pushed the intermediate branch from 2504406 to 057be29 Compare April 9, 2022 16:14

dlorenc approved these changes Apr 9, 2022

View reviewed changes

dlorenc merged commit 4db32b6 into sigstore:main Apr 9, 2022

haydentherapper deleted the intermediate branch April 9, 2022 17:22

nsmith5 mentioned this pull request Apr 12, 2022

Pluggable KMS integrations sigstore/sigstore#386

Open

haydentherapper mentioned this pull request Apr 28, 2022

Requesting to be a maintainer for Fulcio #547

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add intermediate CA implementation with KMS-backed signer #496

Add intermediate CA implementation with KMS-backed signer #496

haydentherapper commented Mar 31, 2022

haydentherapper commented Mar 31, 2022 •

edited

haydentherapper commented Mar 31, 2022

haydentherapper commented Mar 31, 2022

haydentherapper commented Mar 31, 2022 •

edited

codecov-commenter commented Mar 31, 2022 •

edited

haydentherapper commented Mar 31, 2022

dlorenc commented Mar 31, 2022

haydentherapper commented Apr 1, 2022

priyawadhwa commented Apr 5, 2022

haydentherapper commented Apr 6, 2022

nsmith5 left a comment

nsmith5 left a comment

haydentherapper commented Apr 9, 2022

Add intermediate CA implementation with KMS-backed signer #496

Add intermediate CA implementation with KMS-backed signer #496

Conversation

haydentherapper commented Mar 31, 2022

Summary

Ticket Link

Release Note

haydentherapper commented Mar 31, 2022 • edited

haydentherapper commented Mar 31, 2022

haydentherapper commented Mar 31, 2022

haydentherapper commented Mar 31, 2022 • edited

codecov-commenter commented Mar 31, 2022 • edited

Codecov Report

haydentherapper commented Mar 31, 2022

dlorenc commented Mar 31, 2022

haydentherapper commented Apr 1, 2022

priyawadhwa commented Apr 5, 2022

haydentherapper commented Apr 6, 2022

nsmith5 left a comment

Choose a reason for hiding this comment

nsmith5 left a comment

Choose a reason for hiding this comment

haydentherapper commented Apr 9, 2022

haydentherapper commented Mar 31, 2022 •

edited

haydentherapper commented Mar 31, 2022 •

edited

codecov-commenter commented Mar 31, 2022 •

edited