sounds like a good plan ;), so that means a state or object data is not guranteed or trustworthy until its signed - for example - right?Hi Martin,
Martin Bartosch wrote:
I would like to implement a function sign_object. Everyone can sign a object to signal that he verified the object. This has nothing to do with the state APPROVED. This way of using signatures allows the old style management (only issuing certs from approved and signed requests) but it supports much more things too.
A RA operator can sign a pending request for a CA operator certificate to signal a CA operator that the data in the request is checked. Nevertheless only a CA operator can approve the request. The idea is to allow much more detailed and flexible policies.
sounds good. I remember discussing something similar in November last year or so. Just make sure the signature is just one possible way of adding a 'approval' for a new state. There will be situations where policy demands an environment where signatures are not desired.
In fact, the approval has nothing explicitly to do with the signature any longer. The signature protects/commits the data. The approval signals a state. So a signature does not add a 'approval'. It only protects the data against manipulation.
if we are at securing stuff - i would suggest, (its not direct connected to the object things ;) a configure option to sign/encrypt data-exchange - so data send from ra to ca gets signed/encrypted and vice versa...
so the ca can proof, the data is from a 'known' and 'trusted' ra-part of the infrastructure, so the ra can trust the data as to be from the real ca...
so there may be in the setup procedure also an option to generate exchange keys/certs for data-transport...
but i'm not sure if this is necessary, but i think it would be a good idea, if config-data gets pushed from ca to substructure elements, it should be somehow trustworthy whith what i overwrite my configuration down there at lower levels ;)
greetings dalini
------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ OpenCA-Devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/openca-devel
