Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(plugin)!: pass payload digest when generate-signature #185

Closed
wants to merge 7 commits into from

Conversation

shizhMSFT
Copy link
Contributor

@shizhMSFT shizhMSFT commented Aug 15, 2022

Changes to SIGNATURE_GENERATOR.RAW capability:

  • payloadDigest instead of payload is passed in generate-signature.request.
    • Since only the digest of the payload is required, the plugin can fit crypto.Signer, and it simplifies the implementation of notation-core-go.
    • For the concern of the FIPS-compliance of hash implementation, it is not sufficient to delegate the hash computation to the plugin as notation-go still uses golang built-in hash implementation to do signature and certificate validation. For advanced scenarios, it should be considered compiling notation under FIPS-compliant golang or implementing a plugin with SIGNATURE_GENERATOR.ENVELOPE capability.

Signed-off-by: Shiwei Zhang shizh@microsoft.com

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
@shizhMSFT
Copy link
Contributor Author

This PR is also for COSE support since the Signer of go-cose accepts digests only.

@priteshbandi
Copy link
Contributor

* Moved `response.certificateChain` from `generate-signature` to `describe-key`.
  
  * It is redundant to return the same certificate chain.
  * Simplifies the implementation of `notation-core-go` where certificate chain can be obtained without generating any signature.

Moving certificateChain from generate-signature to describe-key opens up an edgecase during certification rotation, where describe-key returns old certificateChain and generate-signature signs with new certificateChain

@shizhMSFT
Copy link
Contributor Author

shizhMSFT commented Aug 16, 2022

Moving certificateChain from generate-signature to describe-key opens up an edgecase during certification rotation, where describe-key returns old certificateChain and generate-signature signs with new certificateChain

As discussed in the community call, I will remove this part out to another PR #187 for discussions.

Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
@shizhMSFT shizhMSFT added this to the RC-1 milestone Aug 16, 2022
@shizhMSFT shizhMSFT changed the title feat!: revise plugin extensibility spec feat(plugin)!: revise plugin extensibility spec Aug 16, 2022
Signed-off-by: Shiwei Zhang <shizh@microsoft.com>
@shizhMSFT shizhMSFT changed the title feat(plugin)!: revise plugin extensibility spec feat(plugin)!: pass payload digest when generate-signature Aug 16, 2022
@shizhMSFT
Copy link
Contributor Author

We can close this PR if veraison/go-cose#101 is merged.

@shizhMSFT shizhMSFT closed this Aug 31, 2022
@dtzar dtzar modified the milestones: RC-1, alpha-4 Sep 29, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

3 participants