Repository navigation
Conversation
The gateway is meant to admit devices by a bearer token from an
issuer its operator configures, checked locally with no call to any
service. This adds the first part of that check: parsing a token and
verifying its signature against the issuer's keys.
Each configured issuer appears once and lists its keys as a JSON Web
Key Set. The keys are checked when the configuration loads: Ed25519,
P-256 and RSA of at least 2048 bits only, never a shared-secret
("oct") key or another curve; "use" equal to "sig" when present; "alg"
matching the key type; a unique "kid"; and no secret-key members
("d", "p", "q", "dp", "dq", "qi", "oth", "k"). An RSA key needs an
exponent. One unusable key refuses the whole
configuration, so a renderer can rely on every listed key being used.
The signing algorithm is fixed by the selected key, never taken from
the token, so a token signed with another algorithm is refused. A
token names its key by "kid", or its issuer must have exactly one key.
A token longer than 8 KiB, or with a "crit" header, is refused before
any other check.
Signatures are verified with the jsonwebtoken crate and its aws-lc
backend, which the gateway already builds through rustls. The crate
accepts shared-secret keys and does not check curves, so the key
checks above run before it sees a key. Nothing calls the verifier
yet; token admission uses it.
Tests cover each refusal, including shared-secret and wrong-curve
keys, a key with secret-key members, and an oversize token.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The gateway is meant to admit devices by a bearer token from an issuer its operator configures, checked locally with no call to another service.
This adds the first part: issuers and their keys in the configuration, checked when it loads, and signature verification with the algorithm fixed by the key. It uses the jsonwebtoken library with the aws-lc backend the gateway already builds.
Nothing uses it until the token admission pull request, the third in this stack.
Test plan
Related to datum-cloud/enhancements#883 and datum-cloud/enhancements#916