Linux Foundation, BastionZero \u0219i Docker au lansat un nou proiect deschis OpenPubKey, care dezvolt\u0103 protocolul criptografic omonim pentru certificarea digital\u0103 a obiectelor diverse. Tehnologia a fost dezvoltat\u0103 ca un proiect comun \u00eentre BastionZero \u0219i Docker, av\u00e2nd ca scop simplificarea procesului de certificare a imaginilor containerelor Docker cu semn\u0103turi digitale pentru a preveni \u00eenlocuirea acestora \u0219i a confirma construc\u021bia de c\u0103tre creatorul declarat. Proiectul va evolua pe o platform\u0103 neutr\u0103 sub tutela organiza\u021biei Linux Foundation, ceea ce va elimina dependen\u021ba de companii comerciale \u0219i va facilita colaborarea cu participan\u021bi externi. Implementarea de referin\u021b\u0103 OpenPubKey este scris\u0103 \u00een limbajul Go \u0219i este distribuit\u0103 sub licen\u021ba Apache 2.0. <\/p>\n
Func\u021bionalit\u0103\u021bile OpenPubKey nu se limiteaz\u0103 doar la imaginile containerelor, iar tehnologia poate fi utilizat\u0103 pentru a confirma sursa oric\u0103rui tip de resurs\u0103, prevenind \u00eenlocuirea dependen\u021belor \u0219i \u00eembun\u0103t\u0103\u021bind securitatea canalelor de distribuire a seturilor de date. De exemplu, tehnologia este aplicabil\u0103 pentru certificarea construc\u021biilor de software, a mesajelor individuale \u0219i a commit-urilor. Creatorii de semn\u0103turi au nevoie doar de un cont \u00eentr-un serviciu care suport\u0103 OpenID, \u00een timp ce consumatorii au posibilitatea de a verifica semn\u0103turile ata\u0219ate \u0219i de a confirma leg\u0103tura acestora cu identificatorul OpenID declarat. <\/p>\n
Din punct de vedere al func\u021biei, OpenPubKey este similar cu sistemul Sigstore creat de Google \u0219i transferat anterior c\u0103tre Linux Foundation, dar se diferen\u021biaz\u0103 prin simplificarea considerabil\u0103 a implement\u0103rii, utiliz\u0103rii \u0219i \u00eentre\u021binerii datorit\u0103 elimin\u0103rii componentelor serverului centralizat responsabile pentru gestionarea jurnalului public, care confirm\u0103 autenticitatea modific\u0103rilor (transparency log), \u0219i asigurarea func\u021bion\u0103rii autorit\u0103\u021bilor de certificare (Certificate Authority). <\/p>\n
\u00cen loc s\u0103 implementeze centre de autorizare proprii, OpenPubKey utilizeaz\u0103 autentificarea prin tehnologia OpenID \u0219i leag\u0103 semn\u0103turile create de furnizorii existen\u021bi de OpenID Connect. Cu alte cuvinte, OpenPubKey permite asocierea cheilor criptografice cu utilizatori specifici prin intermediul furnizorilor OpenID Connect (IdP) \u00een loc de centrele de autorizare. Tehnologia este complet compatibil\u0103 cu furnizorii OpenID existen\u021bi, cum ar fi GitHub, Azure\/Microsoft, Okta, OneLogin, Keycloak \u0219i Google, \u0219i nu necesit\u0103 modific\u0103ri din partea lor (folosind tipul de ID Token furnizat de furnizor, ceea ce permite implementarea OpenPubKey doar prin modific\u0103ri pe partea clientului OpenID Connect). <\/p>\n
Tokenul OpenID emis de furnizor este transformat \u00eentr-un certificat care leag\u0103 \u00een mod criptografic identificatorul \u00een OpenID Connect de cheia public\u0103. Ulterior, utilizatorul folose\u0219te cheia generat\u0103 pentru a semna orice date, iar aceste semn\u0103turi pot fi verificate ulterior \u00een raport cu identificatorul din OpenID Connect. \u00cen OpenPubKey se aplic\u0103 chei efemere, a c\u0103ror durat\u0103 de via\u021b\u0103 este limitat\u0103 \u2014 cheile sunt generate \u00een timpul autentific\u0103rii cu OpenID \u0219i sunt \u0219terse la finalizarea sesiunii cu furnizorul OpenID. <\/p>\n
Algoritmul aproximativ pentru crearea unei semn\u0103turi utiliz\u00e2nd OpenPubKey: <\/p>\n
Verificarea se reduce la a stabili dac\u0103 tokenul ata\u0219at a fost semnat de furnizorul OpenID \u0219i la validarea corectitudinii semn\u0103turii digitale a resursei cu cheia public\u0103, ceea ce permite asigurarea c\u0103 resursa a fost semnat\u0103 folosind identificatorul din certificat \u0219i c\u0103 acest lucru este confirmat de semn\u0103tura furnizorului OpenID. De exemplu, cel care genereaz\u0103 semn\u0103tura poate ob\u021bine un token semnat de furnizorul OpenID Google cu informa\u021bia c\u0103 este verificat ca bob@gmail.com \u0219i folose\u0219te cheia public\u0103 0x54A5\u2026FF. Ulterior, la primirea unui mesaj semnat cu aceea\u0219i cheie, cel care prime\u0219te poate utiliza tokenul semnat de furnizor pentru a verifica c\u0103 cheia bob@gmail.com \u2014 0x54A5\u2026FF \u0219i mesajul au fost cu adev\u0103rat semnate de bob@gmail.com. <\/p>\n
Simplificarea arhitecturii a fost realizat\u0103 prin anumite compromisuri (de exemplu, dependen\u021ba de furnizorii externi OpenID \u0219i lipsa unui jurnal de modific\u0103ri cu hash-uri ierarhice), care \u00een anumite situa\u021bii sunt acceptabile, iar \u00een altele nu. Pentru a reduce dependen\u021ba de furnizorii OpenID, al c\u0103ror compromis sau ac\u021biuni ale personalului pot compromite sistemul (de exemplu, un furnizor piratat poate emite o cheie fals\u0103 unei ter\u021be p\u0103r\u021bi), se propune utilizarea unui element suplimentar, dar op\u021bional, MFA-Cosigner (Cosigner pentru Autentificare Multifactor) pentru autentificarea multifactorial\u0103 (tokenul trebuie s\u0103 fie semnat nu doar de furnizorul principal, ci \u0219i de un serviciu independent de autentificare care confirm\u0103 utilizatorul). <\/p>\n
Printre sl\u0103biciunile OpenPubKey se num\u0103r\u0103 prezen\u021ba informa\u021biilor externe, care pot fi utilizate pentru urm\u0103rirea activit\u0103\u021bii pe o perioad\u0103 lung\u0103 de timp \u0219i independent de redenumiri (reutilizarea tokenului identificator \u00een loc de un certificat nou). Leg\u0103tura direct\u0103 cu cheile OpenID Connect \u00een timpul verific\u0103rii exclude partea de server, dar complic\u0103 semnificativ implementarea pe partea clientului \u0219i las\u0103 mai mult spa\u021biu de manevr\u0103 pentru atacuri (suprafa\u021ba de atac) asupra clientului, de exemplu, din cauza faptului c\u0103 sarcina rota\u021biei cheilor revine clientului. Lipsa unui jurnal al modific\u0103rilor nu permite clientului s\u0103 monitorizeze posibilele scurgeri de chei. Linux Foundation, BastionZero \u0438 Docker \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 OpenPubKey, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u044b\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432. \u0422\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u0430 \u043a\u0430\u043a \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 BastionZero \u0438 Docker \u0441 \u0446\u0435\u043b\u044c\u044e \u0443\u043f\u0440\u043e\u0449\u0435\u043d\u0438\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u044b\u043c\u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u044f\u043c\u0438 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 Docker \u0434\u043b\u044f \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0438\u0445 \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0438 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u0431\u043e\u0440\u043a\u0438 \u0437\u0430\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0435\u043c. \u041f\u0440\u043e\u0435\u043a\u0442 \u0431\u0443\u0434\u0435\u0442 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043b\u043e\u0449\u0430\u0434\u043a\u0435 \u043f\u043e\u0434 \u043f\u043e\u043a\u0440\u043e\u0432\u0438\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-110683","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A fost prezentat OpenPubKey, protocolul de verificare criptografic\u0103 a obiectelor | ProHoster","description":"Linux Foundation, BastionZero \u0219i Docker au lansat un nou proiect open source OpenPubKey, care dezvolt\u0103 protocolul criptografic omonim pentru certificarea semn\u0103turii digitale a obiectelor diverse.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/predstavlen-openpubkey-protokol-kriptograficheskoj-verifikaczii-obektov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d OpenPubKey, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 | ProHoster","og:description":"Linux Foundation, BastionZero \u0438 Docker \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u043d\u043e\u0432\u044b\u0439 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0440\u043e\u0435\u043a\u0442 OpenPubKey, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0438\u0439 \u043e\u0434\u043d\u043e\u0438\u043c\u0451\u043d\u043d\u044b\u0439 \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0434\u043b\u044f \u0437\u0430\u0432\u0435\u0440\u0435\u043d\u0438\u044f \u0446\u0438\u0444\u0440\u043e\u0432\u043e\u0439 \u043f\u043e\u0434\u043f\u0438\u0441\u044c\u044e \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/predstavlen-openpubkey-protokol-kriptograficheskoj-verifikaczii-obektov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-08T13:10:18+00:00","article:modified_time":"2023-10-08T13:10:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110683","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=110683"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/110683\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=110683"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=110683"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=110683"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"