Subject: [Rift] Initial implementation of security in RIFT-Python is complete

From: Bruno Rijsman <[email-masked]>
Date: Mon, 22 Apr 2019 20:16:47 -0300

I have finished the initial implementation of security in RIFT-Python (security envelope, keys, fingerprints, nonces, packet-nr, etc. etc.)

See http://bit.ly/rift-python-security-feature-guide <http://bit.ly/rift-python-security-feature-guide> for a detailed feature guide.

While implementing the code, I gathered a number of comments on the security section of the draft -05. I will report these in a follow-up e-mail.

-- Bruno

---

From: Antoni Przygienda <[email-masked]>
Date: Wed, 24 Apr 2019 17:47:29 +0000

read your guide in detail. makes all perfect sense. will extend schema to what you suggest so inter'op ...

thanks

--- tony

________________________________
From: Bruno Rijsman <[email-masked]>
Sent: Monday, April 22, 2019 4:16 PM
To: [email-masked]
Subject: Initial implementation of security in RIFT-Python is complete

See http://bit.ly/rift-python-security-feature-guide<https://urldefense.proofpoint.com/v2/url?u=http-3A__bit.ly_rift-2Dpython-2Dsecurity-2Dfeature-2Dguide&d=DwMCAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=htkOLD_Mz6ekfr_iYDTC5Q7xzPbroaycphOlQuwgDAg&s=t-P4E1fGgdJ6fiTwi2uXPbhcMxKse2r47pppAq8EO_I&e=> for a detailed feature guide.

-- Bruno

---

From: Tony Przygienda <[email-masked]>
Date: Thu, 25 Apr 2019 20:15:12 -0700

Ok, I looked over the stuff in more detail again and I see that the yaml
schema is only a limited security model and would hence like to extend it a
bit. Let me know what you think

At the top I'd like to add private-secret to support private/public key and
not only shared

{?} keys:
    {+} - id: <24-bit key number>
    {1}   algorithm: [hmac-sha-256]
    {1}   secret: <string>
    {?}   private-secret: <string>

*under -name (i.e. per node) it would be good to have *

{?}      tie_validation: [none|permissive|loose|strict]

to support testing of the common models of processing of signatures

Then under interface we'd need

{?}           active_key: <8-bit key number>
{?}           accept_keys: <set of 8-bit key number>
{?}           lie_validation: [none|permissive|loose|strict]  (6)

so we can test mix of interfaces using different keys and not using them ta
all (we can share the global keys for that purpose since it's simpler but
can only use the 8-bit IDs)

--- tony

On Wed, Apr 24, 2019 at 10:47 AM Antoni Przygienda <prz=
[email-masked]> wrote:

> ------------------------------
> *From:* Bruno Rijsman <[email-masked]>
> *Sent:* Monday, April 22, 2019 4:16 PM
> *To:* [email-masked]
> *Subject:* Initial implementation of security in RIFT-Python is complete
>
> I have finished the initial implementation of security in
> RIFT-Python (security envelope, keys, fingerprints, nonces, packet-nr, etc.
> etc.)
>
> See http://bit.ly/rift-python-security-feature-guide
> <https://urldefense.proofpoint.com/v2/url?u=http-3A__bit.ly_rift-2Dpython-2Dsecurity-2Dfeature-2Dguide&d=DwMCAg&c=HAkYuh63rsuhr6Scbfh0UjBXeMK-ndb3voDTXcWzoCI&r=maKXfKzgRTpiLitqHnJiww&m=htkOLD_Mz6ekfr_iYDTC5Q7xzPbroaycphOlQuwgDAg&s=t-P4E1fGgdJ6fiTwi2uXPbhcMxKse2r47pppAq8EO_I&e=> for
> a detailed feature guide.
>
> While implementing the code, I gathered a number of comments on the
> security section of the draft -05. I will report these in a follow-up
> e-mail.
>
> -- Bruno
> _______________________________________________
> RIFT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/rift
>