Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fdo-manufacturing-client plain-di does work #477

Open
nak3 opened this issue Apr 17, 2023 · 1 comment · May be fixed by #553
Open

fdo-manufacturing-client plain-di does work #477

nak3 opened this issue Apr 17, 2023 · 1 comment · May be fixed by #553

Comments

@nak3
Copy link
Contributor

nak3 commented Apr 17, 2023 •
edited
Loading

As described in https://fedora-iot.github.io/fido-device-onboard-rs/specs/diun.html,
manufacturing-server needs to get public key prior to the start of the protocol.

Currently manufacturing-server tries to load the public key here:

https://github.com/fedora-iot/fido-device-onboard-rs/blob/69fec227de04d98c51a5b5d8eb218bdc264f0a3f/manufacturing-server/src/handlers/di.rs#L77-L84

but there are several problems for it.

  1. The file path is {public_key_store}/{msg_info}, which msg_info is not a pub key file name. It should allow uses to set the path like public_key_path via configfile.
  2. It calls store.load_data() to load the public key but load_data() deserialize the public key. It is not practical that users need to set the public key with the format change.

Also, there is no integration test to reveal fdo-manufacturing-client plain-di does not work.
@nak3 nak3 mentioned this issue Apr 17, 2023
Open
@7flying
Copy link
Contributor

7flying commented Apr 25, 2023 •
edited
Loading

  1. We already configure it with a configuration file (https://github.com/fedora-iot/fido-device-onboard-rs/blob/main/examples/config/manufacturing-server.yml#L10); the mfg_info there specifies the file inside that directory, which matches a device's serial number or MAC address, and it's what we use to uniquely identify a device.

  2. I agree, it expects cbor and makes the rest fail because we are supplying plain data

@7flying 7flying mentioned this issue Apr 25, 2023
Open
puiterwijk added a commit to puiterwijk/fido-device-onboard-rs that referenced this issue Sep 7, 2023
@puiterwijk
Deserialize plain DI certs as raw DER
abc9043 
Because of the deserialize implementation that's automatically
generated, at this moment the expected value for the public_key_store
in the manufacturing server is a CBOR array of the DER certificate.
This commit adds a new type PlainBytes which (de)serializes
transparently, and makes the manufacturing server use it for the public
key store.

NOTE: this means that with this patch, the store format on disk changes.
This store is a ReadOnly (the server will never write to it), but if
anyone would've put a CBOR file in place, that will now fail to open.
Raw DER was always the intention (and documented) format, but it still
is a risk.

Signed-off-by: Patrick Uiterwijk <[email protected]>
Fixes: fdo-rs#477
@puiterwijk puiterwijk linked a pull request Sep 7, 2023 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Deserialize plain DI certs as raw DER puiterwijk/fido-device-onboard-rs
2 participants
@nak3 @7flying