Skip to content
This repository has been archived by the owner on Mar 29, 2022. It is now read-only.

WIP: Timeserver key rotation #171

Open
wants to merge 17 commits into
base: develop
Choose a base branch
from
Open

WIP: Timeserver key rotation #171

wants to merge 17 commits into from

Conversation

awwad
Copy link
Contributor

@awwad awwad commented Mar 4, 2019 •
edited
Loading

This is the last PR in a series of four intended to handle Issue #173.

This PR adds timeserver key rotation through root metadata, handling fast-forward attacks that hijack the timeserver key to push current time to some value in the future, expiring all metadata and preventing update.

Fixes #173

Note that this will not be polished and merged until after:

  • the TUF roledb-et-al rewrite for TUF issue #660
  • completion of the addition of ASN.1/DER support to the main TUF codebase
  • migration of this implementation's TUF dependency from the upTUF fork to the main TUF codebase

@awwad awwad mentioned this pull request Mar 7, 2019
Open
4 tasks
@awwad awwad self-assigned this Mar 7, 2019
@awwad awwad force-pushed the timeserver_key_rotation branch 3 times, most recently from 3aa0567 to fca8f8d Compare March 12, 2019 16:44
@awwad
WIP: support timeserver key rotation through root metadata
d99d2e3 
handling fast-forward attacks that hijack the timeserver key to
push current time to some value in the future, expiring all
metadata and preventing update.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: retrieve timeserver key metadata correctly
3bd9c6b 
in clients secondary.py and primary.py.

The mechanism for retrieving metadata from the TAP4-conforming
multi-repository-updater is the Updater.get_metadata() call.

Note that until the test metadata includes timeserver keys,
the tests will still fail.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad awwad mentioned this pull request Mar 15, 2019
Merged
3 tasks
@awwad
PR revision: casing on Timeserver "role" t->T to match uptuf
2472f32 
(to match uptuf's old expectations regarding role capitalization).

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Update sample/test metadata to include Timeserver keys in root
f052b14 
Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Update more test metadata to include Timeserver keys in root
4595e09 
Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: bugfix refresh failure case if no timeserver rotation
99b9be9 
The prior modifications in this PR caused a failure case:
an <else:raise> was missing.  If an error occurred obtaining
verified metadata, and there was no timeserver key rotation,
we weren't raising the error.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Add sample/test data with the timeserver key rotated
93695ff 
in JSON only.  samples/timeserver_key_rotated has metadata that
is updated from samples/initial_w_no_update, with later version
of Root, Snapshot, and Timestamp, that allow a full verification
Primary or Secondary to verify a new Timeserver key.

For use with upcoming testing.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: correct test/sample root metadata changes
77dcc9d 
- Do not add timeserver keys to the image repo root metadata test/sample
  data.
- Add the public key value where appropriate, not just the keyid.
- Re-sign.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: Add timeserver key rotation to the update clients
9bb5d5a 
- Correct the code handling Timeserver key rotation to recognize that
  keyids+threshold is what is listed in the 'role' metadata in Root,
  and to use that to obtain the full public key value from tuf.keydb.

- Also performs the actual update of the client's noted Timeserver key.
  In a future commit, this should probably be modified a bit such that
  the clients just use the value from metadata via get_metadata() calls
  instead of caching the value (since in this implementation, the
  Timeserver key information will be in every Root version).

- Make notes where more duplicate code has been added to primary.py and
  secondary.py.

- Slightly reorganize code in
  refresh_toplevel_metadata_from_repositories.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Add test of timeserver key rotation to test_secondary.py
a1ccae2 
The test feeds in two sets of metadata, the second of which has a
different Timeserver key listed.

This checks to make sure that the key change is taken into account
by the clients, but it does not yet test the fast-forward attack.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: correct the epoch-start time format in the clients
d83ebec 
This is the value used in all_valid_timeserver_times() after
a Timeserver key rotation, and is also the value used to set
tuf.conf.CLOCK_OVERRIDE.  They were previously set to time.gmtime(0),
which is the wrong type.  They are now correctly set to an
iso8601 value.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Test Timeserver fast forward attack and resolution
603284a 
test_secondary.test_95_timeserver_fastforward_attack

We add an additional test client (bringing us to 4
test Secondary clients).

Resolution uses rotation of the Timeserver key.

See:
- #173
- uptane/uptane-standard#41

This commit also improves the prior test added in this PR,
test_90_timeserver_key_rotation, adding a few checks and
improving readability and comments.

This requires a bit more editing.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: fix bug in clock reset instruction
b8bdf4f 
Now that a local uptuf branch has had some issues fixed, I got
through to this line and saw an obvious issue. :)

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
DEBUG: use uptuf branch with fixed expiration checks
a036ab2 
THIS COMMIT SHOULD NOT BE MERGED AND IS HERE FOR TESTING PURPOSES.
The uptuf branch pointed to here is expected to be merged into
develop, at which point this commit will cease to make sense.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: DOC: minor test clarification comment in test_secondary
02e3a7f 
Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
PR revision: adjust timeserver ff atk test to anticipate PR 179
8b72681 
Adjust the timeserver fast-forward attack test in this PR to
anticipate the merging of PR 179.  PR 179 enforces that the
Director repository is updated before other repositories.

This is required by the Uptane Standard, and is also useful in
handling the fast-forward attack.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
@awwad
Guarantee clients update the Director repo before Image repo
59b4ca2 
This is important for conformance to the Uptane Standard and to
be able to resolve Timeserver fast-forward attacks.

Signed-off-by: Sebastien Awwad <sebastien.awwad@gmail.com>
This was referenced Mar 27, 2019
Closed
Merged
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees

@awwad awwad

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@awwad