• source navigation  • diff markup  • identifier search  • freetext search  • 


  1 # ucert
  3 ucert is a signature-chaining wrapper around usign using blob and blobmsg.
  4 It's meant to be used for OpenWrt routers and uses libubox for most things, to allow dumping certificates in JSON format libjson-c and libblobmsg-json are used as well.
  6 ## a few words about security
  7 ucert inherits all its cryptographic properties from the underlying **usign** implementation which as such may not have been meant to be used in such a way.
  8 To maintain a high cryptographic standard, it is likely that further optimization of the signed payload format (reduce known-plaintext by normalization, add salts in case usign doesn't, ...) has to be carried out.
  9 The parsers are inherited from libubox, and despite the extremely good reputation of the blob it must not be unmenetioned that libubox also most likely wasn't intended to be used for cryptographic purposes.
 10 Yet it does provide the mechanisms needed (data-encapsulation, parsing, ...) in a way much more straight forward than any ASN.1 implementation ever could at a fraction of the source footprint.
 13 ## handling revokation
 14 ucert generates a revoker certificate for each issued authorization certificate. Unlike X.509, the revokation mechanism is rather flat: It only allows keys present in pubkeydir (ie. /etc/opkg/keys) to revoke any other key. There are no means for delegation of revokation or anything the like.
 16 When ucert is called with the `-R` command to process a chain of revokers, each of them is verified against the pubkeydir. Once validated, a dead symlink for the revoked key is created in /etc/opkg/keys.
 18 Currently the signatures of the to-be-revoked keys are signed one-by-one -- if that turns out to be a scalability concern, revokation could easily be changed to operate with lists of to-be-revoked pubkeys. The advatage of the current implementation is that revokers can simple be appended and hence who ever takes care of the update or provisioning mechanism serving those revokers doesn't need to know anything about the internal affairs of ucert. They can simply use `cat`.
 20 ## usage
 21 ```shell
 22 Usage: ucert <command> <options>
 23 Commands:
 24   -A:                   append signature (needs -c and -x)
 25   -D:                   dump (needs -c)
 26   -I:                   issue cert and revoker (needs -c and -p and -s)
 27   -R:                   process revoker certificate (needs -c and -P)
 28   -V:                   verify (needs -c and -p|-P, may have -m)
 29 Options:
 30   -c <file>:            certificate file
 31   -m <file>:            message file (verify only)
 32   -p <file>:            public key file
 33   -P <path>:            public key directory (verify only)
 34   -q:                   quiet (do not print verification result, use return code only)
 35   -s <file>:            secret key file (issue only)
 36   -x <file>:            signature file
 37 ```
 39 ### examples
 40 ```shell
 41 # on airgap system
 42 # create root keypair (which never leaves airgap)
 43 usign -G -p capubkey -s caseckey
 44 # create delegate keypair
 45 usign -G -p pubkey -s seckey
 46 # create ca-signed delegate cert (and revoker)
 47 ucert -I -p pubkey -s caseckey -c newcert
 49 # eg. on buildbot worker
 50 # got newcert and seckey from airgap
 51 # sign content
 52 usign -S -m message.bin -s seckey -x message.bin.sig
 53 # create cert for message
 54 cp newcert message.bin.ucrt
 55 ucert -A -c message.bin.ucrt -x message.bin.sig
 57 # on (OpenWrt) client
 58 # get revokers periodically eg. via http and process them:
 59 ucert -R -P /etc/opkg/keys -c all-revokers.ucrt
 60 # verify message with ucert against pubkeys in /etc/opkg/keys
 61 ucert -V -P /etc/opkg/keys -m message.bin -c message.bin.ucrt && echo message.bin verified successfully
 62 ```

This page was automatically generated by LXR 0.3.1.  •  OpenWrt