Timeline for Openpubkey SSH workflow details
Current License: CC BY-SA 4.0
21 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 1 at 18:14 | comment | added | Ethan Heilman | @ieggel That's completely correct, it is the core idea behind OpenPubkey. Edited my answer to add those details. We also support using the audience (aud) claim for this and just added GQ-based bindings so we can support OPs that don't let the client specify the nonce or the aud. github.com/openpubkey/openpubkey/pull/143 | |
| Apr 1 at 18:11 | history | edited | Ethan Heilman | CC BY-SA 4.0 |
provide slightly more detail
|
| Mar 28 at 10:52 | comment | added | ieggel | @Ethan Heilman: I think here is the code that computes the nonce from the protected header and here the code that checks that it is the same as the nonce provided as a claim signed by the OP. | |
| Mar 28 at 10:52 | comment | added | ieggel | @Ethan Heilman: I think maybe you could also mention under That PK Token is valid according to the rules of OpenPubkey... that the the verifier checks that the nonce claim in the PK token is the same as the hash of the PK token's protected header containing alice-pubkey and the random number. If i got it right this is one of the key concepts in OPK, actually proving that the OP signed alice-pubkey. | |
| Mar 28 at 8:02 | comment | added | ieggel |
@Ethan Heilman: Thanks for the hint, I did not see the special char on the base64 decoded string. I got it into a single command on bash now: ssh-keygen -L -f id_ecdsa.pub | awk '/openpubkey-pkt/{print $4}' | xxd -r -p | base64 | base64 -d | base64 -d --ignore-garbage
|
|
| Mar 28 at 4:41 | comment | added | Ethan Heilman | If you ask this as stackoverflow question, I can provide a easier to read answer. | |
| Mar 28 at 4:40 | comment | added | Ethan Heilman | @ieggel The SSH Certificate (id_ecdsa.pub) is base64 encoded, but SSH encodes the values in the extensions. Your best bet is to use golang ssh.ParseAuthorizedKey (see github.com/openpubkey/openpubkey/blob/main/examples/ssh/sshcert/… for an example use of this). If you really want to do it by hand: 1. ssh-keygen -L -f ~/.ssh/id_ecdsa.pub 2. Decode hex encoded openpubkey-pkt output to get base64 using base64.guru/converter/encode/hex 3. base64 decode this, to get more base64 4. delete the first base64 character and base64 decode again | |
| Mar 27 at 16:48 | comment | added | ieggel |
@Ethan Heilman: Out of curiosity I'd like to extract the pk token from the ssh certificate. In your code it seems to have been base64 encoded, however when i look at the cert itself via ssh-keygen -L -f id_ecdsa.pub, i can see something that resembles a hex string for the openpubkey-pkt extension. Somehow cannot get it to show me the expected json, tried various things via bash, however no success so far.
|
|
| Mar 26 at 14:36 | comment | added | Ethan Heilman | @ieggel Thanks, glad to hear i! Keep the OpenPubkey questions coming | |
| Mar 25 at 13:10 | comment | added | ieggel | @Ethan Heilman: Thanks. This is how I understood it, but I was not sure. Your modified answer makes is crystal clear now. Thanks for your support. Also thanks to Mike in your team for helping me with the installation, as there were some issues with the installation binary. I tested everything and it works flawlessly. Great job. | |
| Mar 23 at 15:58 | history | edited | Ethan Heilman | CC BY-SA 4.0 |
Expanded on my answer based on a additional question
|
| Mar 23 at 15:44 | comment | added | Ethan Heilman | @ieggel The AuthorizedKeyCommand job here is to take the SSH certificate to check if the SSH Certificate is valid or not. If the SSH Certificate is valid, AuthorizedKeyCommand returns a public key that will verify the SSH Certificate to signal to the ssh-server that it is valid. For our purposes AuthorizedKeyCommand would just work as well if it returns "true or false." Let me try to edit this better into the answer. | |
| Mar 22 at 16:22 | history | edited | Michael come lately | CC BY-SA 4.0 |
Expand possibly-ambiguous acronym for its first use.
|
| Mar 22 at 15:32 | history | edited | Michael come lately | CC BY-SA 4.0 |
Minor grammar and markdown formatting improvements
|
| Mar 22 at 15:22 | comment | added | Michael come lately | "I hope transform my answer here into documentation." Did you mean "I hope to transform" or "I hope they transform" ? | |
| Mar 22 at 11:34 | comment | added | ieggel |
I am still not sure about the very last step. So if I understand right, the AuthorizedKeysCommand returns the CA pub key (in this case alice-pubkey => cert-authority <alice-pubkey>), which is used to verify the SSH certificate's signature (signed by alice-privkey)? You said 'The security impact of not signing the ssh certificate would be small, the ssh connection would still fail when the user attempts to perform an ssh handshake without the correct public key'. I don't quite get it, would you mind explaining?
|
|
| Mar 22 at 10:45 | comment | added | ieggel | Thank you for the very detailed answer @Ethan, this is really detailed and helpful, also the PR link you provided is excellent. | |
| Mar 22 at 10:41 | vote | accept | ieggel | ||
| Mar 21 at 15:08 | history | edited | Ethan Heilman | CC BY-SA 4.0 |
Additional links to documentation
|
| S Mar 21 at 14:57 | review | First answers | |||
| Mar 21 at 15:10 | |||||
| S Mar 21 at 14:57 | history | answered | Ethan Heilman | CC BY-SA 4.0 |