Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Reporting server does not validate EDP public key signature before encrypting RequisitionSpec #823

Closed
SanjayVas opened this issue Jan 24, 2023 · 0 comments · Fixed by #825
Closed

Reporting server does not validate EDP public key signature before encrypting RequisitionSpec #823

SanjayVas opened this issue Jan 24, 2023 · 0 comments · Fixed by #825
Assignees
@SanjayVas
Labels
bug Something isn't working triaged Has been triaged by Halo eng

Comments

@SanjayVas
Copy link
Member

SanjayVas commented Jan 24, 2023 •
edited
Loading

The Reporting server acts on behalf of a MeasurementConsumer. It is therefore responsible for encryption and signatures.

As part of the consent signaling protocol, the MC should verify that the encryption public key provided by the CMMS API for the EDP indeed came from the EDP.

https://rally1.rallydev.com/#/?detail=/defect/683915011429&fdp=true
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@SanjayVas SanjayVas

Labels
bug Something isn't working triaged Has been triaged by Halo eng
Projects
None yet
Milestone
No milestone
1 participant
@SanjayVas