Subversion Repositories DevTools

Notes on Signature Generation

The process is to generate a signature for every file in the manifest and the manifest itself.
The signature is held in a .sig file.
The format of the .sig file is Vix's.
    The format is:
        Line-1: The name of the certificate to verify the signature
        Line-2: Base64 signature of the file

Security features involve:
    * The device is provided with the certificate used to verify the siganuture
      It will be in the manifest

    * The device MUST verify the certificate

    * The Root CA MUST be placed onthe device during Day-0

    * The signature MUST be generated on a specail machine.
      Its special because it has the privite key for the certificate


There are for files involved in the process:

VixPulseManifestRootCA.key
    Super super secret key used to generate the Root CA
    Only every used to create VixPulseManifestRootCA.key.crt
    Only every used to create VixPulseManifest.crt and other certificates of the same class
    Held in 1Password

VixPulseManifestRootCA.crt  
    Super super secret certificate used to generate the Root CA
    Used to create VixPulseManifest.crt and other certificates of the same class
    Used to verify VixPulseManifest.crt and other certificates of the same class 
    Installed on devices as a part of Day-0
    Held in the package - manifest-certificates
    Held in 1Password

VixPulseManifest.key  
    Secret key used to generate signatures over all files in the manifest and the manifest itself 
    Held in 1Password
    Installed (manually) on a controlled build machine

VixPulseManifest.crt
    Pulic certificate used to verify signatures created with VixPulseManifest.key
    Installed on the devices as a part of the manifest.
    The security involves verifying the certificate against a RootCA that was installed on the device
    during commisioning. 
    Held in 1Password
    Held in the package - manifest-certificates

-------------------------------------------------------------------------------
Generation of the RootCA and other key/certificate key pairs

The RootCA should only be generated once.
Other key/certificate paisrs can be generated as needed.

The process for generating the RootCa is scripted - see genCerts/genRoot.sh
The process for generating one key/cert is scriped - see genCerts/genCert.sh
    These scripts are provided for future reference

Process for creating another manifest certificate:
    * Get VixPulseManifestRootCA.key / VixPulseManifestRootCA.crt from one password
    * Place in the same directory as the genCert.sh script
    * Edit the genCert.sh and change the value for CLIENT_FQDN
        It must be different to all others generated from the same CA
        
    * Place the generated .crt file in the directory 'src/etc/manifest' 
      Place the file under version control