0

so I'm trying to solve an issue at work. We have a popular key value store which does security via tokens. The kv store issues a specific token which dictates which clients can query which keys.

I want to write a micro service which aids other micro services in obtaining this token. The idea is the auth microservice (the one issuing the token to other services) will have a public key in its database which corresponds with a private key that each service which needs access to kv store (and thus needs a token) owns.

The service which needs a token will query the auth service with its name, and it's private key (over ssl). If the auth service validates that the private key corresponds mathematically to the public key, then the auth service should return the token.

This seems to be a solid idea but I need some ideas on how to accomplish this. On all the pycrypto tutorials I see, they are about encrypting and decrypting a message, but that's not exactly what I want to do. I just want the auth service to know about the keys, and when presented with a public key, just say "yes" this matches your private key, here's the token.

Reading my outline could I get some suggestions of the best way to go about this methodology?

1
  • So I'm actually modeling this idea from salt stack. It looks as if the salt master knows about both keys, but I could be wrong. The main thing I need out of this is a way for the auth service to say HEY YOU DEFINITELY ARE SERIVCE01. I do agree however sending the private key every time it requests it seems to defeat the purpose of pki, hence why I reached out here to think of the "right" way. I can check out mutual auth ssl, I'm not too familiar with security concepts Jul 1, 2016 at 23:24

1 Answer 1

1

First, you don't pass private keys to another service. In general, a key should be considered compromised if it is ever passed to another service. If you want to totally trust the authentication microservice, then just use passwords for authentication. You can generate them in a secure manner manner avoid weak passwords.

The right way to authenticate with asymmetric encryption is to use a challenge-response model. In this, the authentication service would generate a random number, encrypt it using the client's public key, and then pass the encrypted value to the client. By responding with the clear-text secret, the client proves that they have the private key corresponding to the public key in the database. So the messages would basically be:

  1. Client-->Server: Authenticate Alice
  2. Server-->Client: Decrypt encrypt(text, Alice's public key)
  3. Client-->Server: text in clear-text
  4. Server-->Client: Here's your token...

Probably the best way to do this is to use mutual-authentication TLS. That manages the challenge/response within the network stack. By the time the microservice is called, you will already know that the user holds the private key. You can just return the token at that point. The messages would be:

  1. Client-->Server: Give me the token for Alice
  2. Server-->Client: Here's your token...

The first step, where the TLS handshake takes place, will involve multiple on-the-wire messages, but that will be handled automatically.

6
  • This is super helpful! I knew something felt off about sending the key itself. So you're also advising to have the tls infrastructure handle all the challenge and responsive mechanisms. One all those passes, we know the other service is secure, so issue the token if tls successful? Jul 1, 2016 at 23:35
  • @Louis_Santos yes. Jul 1, 2016 at 23:41
  • Can this all be handled by pycrypto ? Jul 2, 2016 at 0:29
  • So diagramming this out, it becomes a little more complicated. So the requesting service needs to identify itself some how, in order for the auth service to look up the correct public key in its database and respond with a successful ssl connection or not. I may need the auth service to be a lower level ssl library, where I can say "okay look at incoming request, check service name, lookup public key, attempt connection..." Jul 2, 2016 at 3:13
  • @Louis_Santos Both the client and server need to support mutual auth. Sorry that I don't know about pycrypto library. For the programming details, stack overflow may be better Jul 2, 2016 at 4:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .