799734 - Implement Java BrowserID crypto library for Android services projects

Status: RESOLVED FIXED

(Firefox for Android Graveyard :: Android Sync, defect, P1)

Description

[Nick Alexander :nalexander [he/him]]

At least needs to generate keypairs, generate assertions, and parse/create JWT tokens.  Could possibly generate certificates for testing.

Comment 1

[Nick Alexander :nalexander [he/him]]

See https://github.com/mozilla-services/android-sync/pull/271 for work in progress and outstanding review comments that have not been addressed.

Comment 2

[Nick Alexander :nalexander [he/him]]

Bulk resolving Firefox Accounts bugs, since that project is dead.  For those interested, similar ideas are being explored under the name PiCL (Profile-in-the-Cloud).

Comment 3

[Nick Alexander :nalexander [he/him]]

Since token server is back in the game, generating BrowserID assertions is back in the game!  As part of syncing against Sync 1.1 servers, but with new auth.  See https://mail.mozilla.org/pipermail/sync-dev/2013-August/000392.html.

Comment 4

[James Bonacci [:jbonacci]]

Fun!

Comment 5

[Nick Alexander :nalexander [he/him]]

Let's get the review fun started!

Comment 6

[Richard Newman [:rnewman]]

First pass done on GitHub.

Curtis, who's the right person to sec-review a BrowserID impl?

Comment 7

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to Richard Newman [:rnewman] from comment #6)
> First pass done on GitHub.
> 
> Curtis, who's the right person to sec-review a BrowserID impl?

I honestly don't know off the top of my head, we'll take it to triage and see who has bandwidth and skill set.

Comment 8

[Nick Alexander :nalexander [he/him]]

(In reply to Curtis Koenig [:curtisk] from comment #7)
> (In reply to Richard Newman [:rnewman] from comment #6)
> > First pass done on GitHub.
> > 
> > Curtis, who's the right person to sec-review a BrowserID impl?
> 
> I honestly don't know off the top of my head, we'll take it to triage and
> see who has bandwidth and skill set.

To be clear: this is code that generates BrowserID certs and assertions, and *not* code that verifies BrowserID assertions.  Still needs sec-review, but not quite as delicate to implement.

Comment 9

[Nick Alexander :nalexander [he/him]]

https://hg.mozilla.org/projects/elm/rev/aaf21c55c69d

Comment 10

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

mgoodwin plan for this to be in Sprint 2

Comment 11

[Nick Alexander :nalexander [he/him]]

To provide sec-review context: (see also https://bugzilla.mozilla.org/show_bug.cgi?id=799732#c10)

This code produces Browser ID certificates and assertions.  We only generate certificates for test purposes: no Android device is a BID IdP so it shouldn't be issuing certificates.  The tricky part here is making sure we generate keys and do the signing correctly, and making sure we format the JSON correctly.

In the Sync flow, we will use the FxAccount server client (Bug 892025) to fetch a BID certificate for the account being synced.  Then we use this code to produce a short-lived BID assertion that is subsequently exchanged for a token server token (using the code in Bug 799732).

Comment 12

[Tim Taubert [:ttaubert] (inactive)]

https://hg.mozilla.org/mozilla-central/rev/aaf21c55c69d