Who signs the service certificate cert_x? #2231
-
|
Hello, CCF Team, thank you for this excellent open-source project. I am curious about the security of the service certificate. Let me use the terms in the CCF technical report to phrase my question. When the first CCF node is created, the service certificate cert_x is created. Here, is cert_x self-signed or signed by another authority? Because cert_x and sk_x also issue certificates for each node's public key pk_n, the issuer of cert_x is quite important. I looked through the CCF documentation but did not find any explanation for this. Is this the right place to ask such questions? Thanks in advance. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
@MingyuanGao this is the right place to ask questions, and it's an excellent question, thank you for your interest in the project! The service certificate is self-signed today (https://github.com/microsoft/CCF/blob/main/src/node/node_state.h#L357). There is no particular reason why it couldn't be endorsed by another identity, the first node could easily produce a CSR rather than a self-signed cert, and make use an endorsed identity once it's available. In practice though, because the network identity is used to endorse individual node identities, it is effectively an intermediate certificate, and so getting it endorsed by a traditional CA would be quite onerous. Other endorsement schemes to tie the nodes in a network to a single TLS identity conditional on governance and enclave attestation have been and continue to be discussed. The issuer of cert_x is definitely important, it's node 0 on the basis of the initial KV state (constitution and members mainly) and its enclave attestation, which can be audited both online and offline via the ledger. |
Beta Was this translation helpful? Give feedback.
-
|
@achamayou Thanks for your clear answer! |
Beta Was this translation helpful? Give feedback.
@MingyuanGao this is the right place to ask questions, and it's an excellent question, thank you for your interest in the project!
The service certificate is self-signed today (https://github.com/microsoft/CCF/blob/main/src/node/node_state.h#L357). There is no particular reason why it couldn't be endorsed by another identity, the first node could easily produce a CSR rather than a self-signed cert, and make use an endorsed identity once it's available.
In practice though, because the network identity is used to endorse individual node identities, it is effectively an intermediate certificate, and so getting it endorsed by a traditional CA would be quite onerous. Other endorsement schemes …