Encrypted AuthContainer payload #14
Conversation
Cipher structures will be used not only from the config package. In the next patch CipherBlock will be used from auth/auth.proto, in order to avoid cycle dependencies move everything cipher related to the evecommon package Signed-off-by: Roman Penyaev <[email protected]>
|
I cannot comment on the content of the change (especially as Erik did that). I can comment on the toolset. It looks like yo ran this using a single step more recent minor version of Can you rerun the |
Avi, as I said in the mail thread I can't install devcontainer. I spent quite a lot of time trying to build it from sources and also failed (I'm on linux, not on mac). I'm not using vscode. The whole procedure of 'make proto' now is inconvenient for me and I expect more complains will follow (the whole eve team is using linux, not mac). I can rebuild the protoc-gen-go, but as I said this is very inconvenient. |
AuthContainer is the envolope for all messages comming from the controller
or sent by EVE. For the LOC the node config should be encrypted. The best
place to provide encryption is to modify the `AuthContainer` itself, so that
the message can be both signed and encrypted (in this exact order).
This patch adds the `cipherData` and `cipherContext` members to the
`AuthContainer` to encrypt the payload. The decrypt and validate
procedure is the following:
1. if `cipherData` is valid the encrypted payload is defined in the
`cipherData.cipherData` member, the `protectedPayload` is set to null.
2. Once EVE stack decrypts the payload, `protectedPayload` member is set
with the decrypted data.
3. The signature verification procedure can follow.
Signed-off-by: Roman Penyaev <[email protected]>
All changes after the 'make proto'. Signed-off-by: Roman Penyaev <[email protected]>
|
@deitch @eriknordmark updated, please take a look. |
There was a problem hiding this comment.
LGTM but if you can pull in #15 you should be able to manually use the devcontainer on Linux.
Thanks, @eriknordmark . These changes work for me. I replied here: #15 (comment) |
|
@eriknordmark @deitch can you please merge this? I don't have write access. |
3 participants
AuthContainer is the envelope for all messages coming from the controller or sent by EVE. For the LOC case the node config should be encrypted. The best place to provide encryption is to modify the
AuthContaineritself, so that the message can be both signed and encrypted (in this exact order).This patch adds the
cipherDataandcipherContextmembers to theAuthContainerto encrypt the payload. The decrypt and validate procedure is the following:cipherDatais valid the encrypted payload is defined in thecipherData.cipherDatamember, theprotectedPayloadis set to null.protectedPayloadmember is set with the decrypted data.CC: @deitch