Linux Foundation, BastionZero a Docker p\u0159edstavily nov\u00fd otev\u0159en\u00fd projekt OpenPubKey, kter\u00fd vyv\u00edj\u00ed stejnojmenn\u00fd kryptografick\u00fd protokol pro ov\u011b\u0159en\u00ed digit\u00e1ln\u00edmi podpisy libovoln\u00fdch objekt\u016f. Technologie byla vyvinuta jako spole\u010dn\u00fd projekt spole\u010dnost\u00ed BastionZero a Docker s c\u00edlem zjednodu\u0161it ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edch podpis\u016f obraz\u016f kontejner\u016f Docker, aby se p\u0159ede\u0161lo jejich z\u00e1m\u011bn\u011b a potvrdila se sestava od deklarovan\u00e9ho tv\u016frce. Projekt se bude rozv\u00edjet na neutr\u00e1ln\u00ed platform\u011b pod patronac\u00ed organizace Linux Foundation, co\u017e vylu\u010duje z\u00e1vislost na jednotliv\u00fdch komer\u010dn\u00edch spole\u010dnostech a usnad\u0148uje spolupr\u00e1ci s \u00fa\u010dastn\u00edky t\u0159et\u00edch stran. Referen\u010dn\u00ed implementace OpenPubKey je napsan\u00e1 v jazyce Go a \u0161\u00ed\u0159\u00ed se pod licenc\u00ed Apache 2.0. <\/p>\n
Mo\u017enosti OpenPubKey se neomezuj\u00ed pouze na obrazy kontejner\u016f a technologie m\u016f\u017ee b\u00fdt pou\u017eita k potvrzen\u00ed zdroje jak\u00e9hokoli zdroje, prevenci z\u00e1m\u011bny z\u00e1vislost\u00ed a zv\u00fd\u0161en\u00ed bezpe\u010dnosti kan\u00e1l\u016f distribuce datov\u00fdch sad. Nap\u0159\u00edklad technologie je pou\u017eiteln\u00e1 k ov\u011b\u0159en\u00ed sestaven\u00ed program\u016f, jednotliv\u00fdch zpr\u00e1v a commit\u016f. Tv\u016frc\u016fm podpisu sta\u010d\u00ed m\u00edt \u00fa\u010det v slu\u017eb\u011b podporuj\u00edc\u00ed OpenID, zat\u00edmco spot\u0159ebitel\u016fm je poskytnuta mo\u017enost ov\u011b\u0159it p\u0159ipojen\u00e9 podpisy a potvrdit jejich vztah s deklarovan\u00fdm identifik\u00e1torem OpenID. <\/p>\n
Sv\u00fdm ur\u010den\u00edm p\u0159ipom\u00edn\u00e1 OpenPubKey v Googlu vytvo\u0159en\u00fd a d\u0159\u00edve p\u0159edan\u00fd Linux Foundation syst\u00e9m Sigstore, ale li\u0161\u00ed se od n\u011bj podstatn\u00fdm zjednodu\u0161en\u00edm implementace, pou\u017eit\u00ed a \u00fadr\u017eby d\u00edky odstran\u011bn\u00ed centralizovan\u00fdch serverov\u00fdch komponent, kter\u00e9 zaji\u0161\u0165uj\u00ed veden\u00ed ve\u0159ejn\u00e9ho logu potvrzuj\u00edc\u00edho pravost zm\u011bn (transparency log) a zaji\u0161t\u011bn\u00ed \u010dinnosti certifika\u010dn\u00edch autorit (Certificate Authority). <\/p>\n
M\u00edsto nasazen\u00ed vlastn\u00edch certifika\u010dn\u00edch center pou\u017e\u00edv\u00e1 OpenPubKey autentizaci pomoc\u00ed technologie OpenID a p\u0159i\u0159azen\u00ed vytvo\u0159en\u00fdch podpis\u016f k existuj\u00edc\u00edm poskytovatel\u016fm OpenID Connect. Jin\u00fdmi slovy, OpenPubKey umo\u017e\u0148uje propojen\u00ed kryptografick\u00fdch kl\u00ed\u010d\u016f s konkr\u00e9tn\u00edmi u\u017eivateli pomoc\u00ed poskytovatel\u016f OpenID Connect (IdP) nam\u00edsto certifika\u010dn\u00edch center. Technologie je pln\u011b kompatibiln\u00ed s existuj\u00edc\u00edmi poskytovateli OpenID, jako jsou GitHub, Azure\/Microsoft, Okta, OneLogin, Keycloak a Google, a nevy\u017eaduje \u017e\u00e1dn\u00e9 zm\u011bny na jejich stran\u011b (pou\u017e\u00edv\u00e1 se poskytovatelem dod\u00e1van\u00fd typov\u00fd ID Token, co\u017e umo\u017e\u0148uje implementaci OpenPubKey pouze prost\u0159ednictv\u00edm zm\u011bn na stran\u011b klienta OpenID Connect). <\/p>\n
Token OpenID vydan\u00fd poskytovatelem je transformov\u00e1n na certifik\u00e1t, kter\u00fd kryptograficky spojuje identifik\u00e1tor v OpenID Connect s ve\u0159ejn\u00fdm kl\u00ed\u010dem. U\u017eivatel pak pou\u017e\u00edv\u00e1 vygenerovan\u00fd kl\u00ed\u010d k podepisov\u00e1n\u00ed jak\u00fdchkoli dat a tyto podpisy mohou b\u00fdt n\u00e1sledn\u011b ov\u011b\u0159eny v souvislosti s identifik\u00e1torem v OpenID Connect. V OpenPubKey se pou\u017e\u00edvaj\u00ed efem\u00e9rn\u00ed kl\u00ed\u010de, jejich\u017e doba \u017eivota je omezena — kl\u00ed\u010de jsou generov\u00e1ny b\u011bhem p\u0159ihl\u00e1\u0161en\u00ed pomoc\u00ed OpenID a odstran\u011bny po skon\u010den\u00ed relace s poskytovatelem OpenID. <\/p>\n
P\u0159ibli\u017en\u00fd algoritmus pro vytvo\u0159en\u00ed podpisu pomoc\u00ed OpenPubKey: <\/p>\n
Ov\u011b\u0159en\u00ed spo\u010d\u00edv\u00e1 v kontrole, zda je p\u0159ipojen\u00fd token podeps\u00e1n poskytovatelem OpenID, a ov\u011b\u0159en\u00ed spr\u00e1vnosti digit\u00e1ln\u00edho podpisu k zdroji pomoc\u00ed ve\u0159ejn\u00e9ho kl\u00ed\u010de, co\u017e umo\u017e\u0148uje ujistit se, \u017ee zdroj byl podeps\u00e1n s pou\u017eit\u00edm identifik\u00e1toru z certifik\u00e1tu a \u017ee to bylo potvrzeno podpisem poskytovatele OpenID. Nap\u0159\u00edklad ten, kdo vytv\u00e1\u0159\u00ed podpis, m\u016f\u017ee obdr\u017eet token podepsan\u00fd poskytovatelem OpenID Google s informac\u00ed, \u017ee byl ov\u011b\u0159en jako bob@gmail.com a pou\u017e\u00edv\u00e1 ve\u0159ejn\u00fd kl\u00ed\u010d 0x54A5…FF. Pot\u00e9 p\u0159i obdr\u017een\u00ed zpr\u00e1vy podepsan\u00e9 t\u00edmto kl\u00ed\u010dem m\u016f\u017ee osoba pou\u017e\u00edt podepsan\u00fd token poskytovatele k ov\u011b\u0159en\u00ed, \u017ee kl\u00ed\u010d bob@gmail.com — 0x54A5…FF a zpr\u00e1vu skute\u010dn\u011b podepsal bob@gmail.com. <\/p>\n
Zjednodu\u0161en\u00ed architektury bylo realizov\u00e1no na z\u00e1klad\u011b ur\u010dit\u00fdch kompromis\u016f (nap\u0159\u00edklad z\u00e1vislost na extern\u00edch poskytovatel\u00edch OpenID a absence logu zm\u011bn s hierarchick\u00fdm hashingem), kter\u00e9 jsou v n\u011bkter\u00fdch situac\u00edch p\u0159\u00edpustn\u00e9 a v jin\u00fdch nikoli. Pro sn\u00ed\u017een\u00ed z\u00e1vislosti na poskytovatel\u00edch OpenID, jejich\u017e kompromitace nebo jedn\u00e1n\u00ed person\u00e1lu mohou znev\u011brohodnit syst\u00e9m (nap\u0159\u00edklad hacknut\u00fd poskytovatel m\u016f\u017ee vydat fale\u0161n\u00fd kl\u00ed\u010d t\u0159et\u00ed stran\u011b), je navrhov\u00e1no pou\u017e\u00edt dodate\u010dn\u00e9, ale nepovinn\u00e9, spojen\u00ed MFA-Cosigner (Multi-Factor Authentication Cosigner) pro v\u00edcefaktorovou autentizaci (token mus\u00ed b\u00fdt podeps\u00e1n nejen hlavn\u00edm poskytovatelem, ale tak\u00e9 nez\u00e1vislou autentiza\u010dn\u00ed slu\u017ebou, kter\u00e1 potvrzuje u\u017eivatele). <\/p>\n
Mezi slab\u00e9 str\u00e1nky OpenPubKey pat\u0159\u00ed tak\u00e9 existence extern\u00edch informac\u00ed, kter\u00e9 lze vyu\u017e\u00edt pro sledov\u00e1n\u00ed aktivity po del\u0161\u00ed dobu a nez\u00e1visle na p\u0159ejmenov\u00e1n\u00edch (opakovan\u00e9 pou\u017eit\u00ed identifikuj\u00edc\u00edho tokenu nam\u00edsto nov\u00e9ho certifik\u00e1tu). P\u0159\u00edm\u00e1 vazba na kl\u00ed\u010de OpenID Connect p\u0159i verifikaci vylu\u010duje serverovou \u010d\u00e1st, ale v\u00fdrazn\u011b zt\u011b\u017euje implementaci na stran\u011b klienta a zanech\u00e1v\u00e1 v\u00edce prostoru pro man\u00e9vrov\u00e1n\u00ed p\u0159i prov\u00e1d\u011bn\u00ed \u00fatok\u016f (attack surface) na klienta, nap\u0159\u00edklad kv\u016fli tomu, \u017ee \u00fakolem klienta je rota\u010dn\u00ed spr\u00e1va kl\u00ed\u010d\u016f. Absence logu zm\u011bn neumo\u017e\u0148uje klientovi sledovat mo\u017en\u00e9 \u00faniky kl\u00ed\u010d\u016f. Linux Foundation, BastionZero \u0438 Docker \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 OpenPubKey, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u044b\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432. \u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u0430 \u043a\u0430\u043a \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 BastionZero \u0438 Docker \u0441 \u0446\u0435\u043b\u044c\u044e \u0443\u043f\u0440\u043e\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker \u0434\u043b\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438\u0445 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0435\u043c. \u041f\u0440\u043e\u0435\u043a\u0442 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0435 \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110683","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159edstavujeme OpenPubKey, protokol kryptografick\u00e9 verifikace objekt\u016f | ProHoster","description":"Linux Foundation, BastionZero a Docker p\u0159edstavili nov\u00fd otev\u0159en\u00fd projekt OpenPubKey, kter\u00fd rozv\u00edj\u00ed stejnojmenn\u00fd kryptografick\u00fd protokol pro ov\u011b\u0159ov\u00e1n\u00ed digit\u00e1ln\u00edm podpisem libovoln\u00fdch objekt\u016f.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlen-openpubkey-protokol-kriptograficheskoj-verifikaczii-obektov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d OpenPubKey, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 | ProHoster","og:description":"Linux Foundation, BastionZero \u0438 Docker \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 OpenPubKey, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u044b\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/predstavlen-openpubkey-protokol-kriptograficheskoj-verifikaczii-obektov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-08T13:10:18+00:00","article:modified_time":"2023-10-08T13:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=110683"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/110683\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=110683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=110683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=110683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"