Closed
Bug 1014726
Opened 11 years ago
Closed 10 years ago
[mig] Use a deterministic json signing/verification method
Categories
(Enterprise Information Security Graveyard :: MIG, task)
Tracking
(Not tracked)
RESOLVED
FIXED
People
(Reporter: jvehent, Assigned: jvehent)
References
Details
Attachments
(1 file)
Camlistore has a nice package to handle the signing of JSON.
https://camlistore.googlesource.com/camlistore/+/master/pkg/jsonsign/
It would most likely be cleaner than the current "stringified json" approach.
|
||
Updated•11 years ago
|
Assignee: nobody → jvehent
|
|
Assignee | |
Comment 1•11 years ago
|
||
|
|
Assignee | |
Comment 2•11 years ago
|
||
I've done some analysis and it doesn't seem like replacing the current signing method with camlistore's brings much value. Signing and verifying still relies on the ordering of the json parameters applied by the json package. For now, since we use the same json encoder/decoder provided by the Go standard lib everywhere, ordering is not an issue. It may be if we start using clients that use various json libs.
Leaving open for future ref.
|
|
Assignee | |
Updated•11 years ago
|
Summary: [mig pgp] replace json signing with camlistore's json signing package → [mig pgp] Use a deterministic json signing/verification method
|
|
Assignee | |
Comment 3•11 years ago
|
||
Need to evaluate https://github.com/square/go-jose for this.
|
|
Assignee | |
Comment 4•11 years ago
|
||
|
|
Assignee | |
Updated•11 years ago
|
Component: Operations Security (OpSec): General → Operations Security (OpSec): MIG
|
|
Assignee | |
Updated•11 years ago
|
Summary: [mig pgp] Use a deterministic json signing/verification method → [mig] Use a deterministic json signing/verification method
Group: mozilla-employee-confidential
Component: Operations Security (OpSec): MIG → MIG
Product: mozilla.org → Enterprise Information Security
Version: other → unspecified
|
|
Assignee | |
Updated•10 years ago
|
Group: mozilla-employee-confidential
|
|
Assignee | |
Comment 5•10 years ago
|
||
Migrated to github issues: https://github.com/mozilla/mig/issues
Status: NEW → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
|
||
Updated•5 years ago
|
Product: Enterprise Information Security → Enterprise Information Security Graveyard
You need to log in
before you can comment on or make changes to this bug.
Description
•