Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide documentation and tooling for generating key values #217

Closed
jrconlin opened this issue Aug 11, 2020 · 4 comments · Fixed by #218 or #231
Closed

Provide documentation and tooling for generating key values #217

jrconlin opened this issue Aug 11, 2020 · 4 comments · Fixed by #218 or #231
Assignees
Labels
2 Estimate - Small enhancement New feature or request good first bug Good for newcomers

Comments

@jrconlin
Copy link
Member

In the python version, we provided instructions on how to generate the fernet crypto_key and other values. It might be worth bringing over the autokey.py into tools and providing some additional docs for how to get it working.

@jrconlin jrconlin added enhancement New feature or request good first bug Good for newcomers 2 Estimate - Small labels Aug 11, 2020
@AzureMarker AzureMarker self-assigned this Aug 11, 2020
@AzureMarker
Copy link
Contributor

I think the Fernet crypto key is the only key that we need to document and provide tooling for? (or at least it's the only one that is documented for Python autopush)

@jrconlin
Copy link
Member Author

I think you're right. I was looking around to see if there were any others.
IIRC: the key values autopush has are:

  • The endpoint fernet key: crypto_key
  • Endpoint Auth key: auth_key
  • UAID hash key_hash

If folks wanted, they could use the same tool to generate the other values as well, but we should note they should be a different values than the fernet key to keep folks from making silly mistakes.

@AzureMarker
Copy link
Contributor

Is UAID key hashing still in use? AFAIK, it isn't and it hasn't been re-implemented in Rust. We can add it back in though if that's required.

@jrconlin
Copy link
Member Author

It's complicated?

The UAID hash was originally suggested to us by an OpSec member, after roll out. We don't currently use it in our production because it would invalidate older records, but if anyone were to set up their own Push server, it's not a terrible idea because it provides some security against correlation if the data were to ever leak out.

This was referenced Oct 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2 Estimate - Small enhancement New feature or request good first bug Good for newcomers
Projects
None yet
2 participants