DFFML Rolling Alice: Engineering Logs: Volume 0: Architecting Alice, 11 May 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Architecting Alice: Volume 0: Context: Part 24: Through the Private Key Encoding Forrest

Description

https://github.com/intel/dffml/discussions/1369#discussioncomment-2726286

A

A

Looks like we are go. So, um let's see, let's reload this page. I think this is stale, confirm.

A

All right, thanks for taking away my url hashtag, so where are we at here's? What we're going to do so uh refresher?

A

Last time we looked at this, we were theorizing about using key base and then hooking into the key base. Proof system. Well, it turns out one of the json webkey algorithm types is the same as an ssh key algorithm type, so we should be able to.

A

um We should be able to um should be able to um just use the same key and kind of do. The same kind of pure did trick right where peer did remember the purity id spec, how that um that, basically.

B

Did I do something wrong? Okay, okay, okay,.

A

All right, here's me okay, so remember how the pure did spec does this.

A

Where oops yeah, where did key, is the same as the id pure0 right. So we're going to do something just like that, where we're going to say did and then you know, for example, key base key or github key and then we're going to put the key right. So.

A

Let's go to the central: did identifier, library.

A

A

A

And let's check out methods.

A

B

A

B

See so there's object energy, onion, pier, let's.

A

Check up here schema, I thought I'd seen, shkima.

B

A

A

Okay, let's check out a few of these. What do we got.

A

Trusted digital web. I don't, I think this list. I don't think we want to deal with that right now, peer! Okay, we know what pure is um schema.

A

Multiple storage networks: I want to know what schema is for sure.

B

A

A

Okay, all right.

A

And then this is web, I'm going to do method web and I think this references, a web address.

A

Okay- and this would be did method web, and this says.

B

That's it specifier, hey, look, there's house.

A

Did web github.io user alice okay, create register creativity is done by applying its domain name register for use domain; okay, creating a did document under the well known, okay and with optional path: okay, okay and that's how you do ports cool.

A

Okay, so this is how we prove.

A

How we prove we own a domain.

A

Did web is how we prove a link between a did and a domain between the key that signed a did and the domain.

A

Which is additional colon.

A

Example and then we'll do the little example that was.

B

A good one give us exactly what we needed. Thank.

A

You very much look at this. This is great. This is great. We don't even have to rename anything all right.

A

A

Okay, so that could be interesting. This could get interesting as we do. You know different. um You know this could be interesting as we uh link our dids to uh in cluster setups, so it could be interesting as we get into oidc and auth within jobs within kcp, okay, cool that could be great right. Then we could basically spin up microservices and they could have their relationship with the with the did via you know, all of the the credential manager stuff that exists within kubernetes already right.

A

So if you have non-uh dffml services that want to consume um anything in web3, because the ffml will proxy it for you, then you're going to you know very easily be able to do that via these web identifiers or web distributed identifiers. um Okay. So, but back back to the problem at hand, um so I think we're just going to encode the key just because I I I I'm uh you know, I don't have all the time in the world. So, let's see.

A

Okay, okay: where were we.

A

Failed to load key invalid format, all right. Well, first thing we're going to do is what does it look like.

A

I weirdly like this pretty print thing where we pass everything as.

B

Okay, so let's see.

A

A

Okay, all right, okay, so the module! I'm worried that I'm going to clobber the namespace here so.

A

All right, let's print some more stuff. So what did we just do? I just made the print function a little more ergonomic here, so that we can. uh We can just print a bunch of stuff so print these two files we're just going to get down.

A

Let's see what happened make sure that worked: okay, args, okay, there we go so our pretty printing helper is working okay, so now gen key looks like it's happy with, but I am curious to see what the contents of that file are. So we can go ahead and just.

A

Dump it like that.

A

Okay, what do we got? Okay begin private key, see that looks okay. That looks like what we're looking for so now. What are we going to do we're going to write out the key.

B

B

Looks good looks good.

A

Okay and then it's not going to be happy with us here or keypad.

A

Okay, invalid format, okay,.

A

All right, converting openness cell to open a search.

A

Key man, why is this so difficult, ssh keyed in and.

B

A

B

B

Hopefulness so just.

B

From format gmp key, how do we do.

A

Sn1, oh, this is nice. I like what they did here.

A

Okay, so basically they're pointing at to different block sizes of things. These are different things within asm1 format. Openssh is private. Key format. Okay looks like they do different decrypt rounds.

A

We can convert openssh keys into pim open. A cell doesn't understand it's interesting to note.

B

That they have decided to not support the pill.

A

Form: okay, a common question among programmers in devops is, if it's possible, to convert into a pem format, as you might have guessed reading the previous sections. The answer is: no. The pump format for private keys uses pkcs number five, so it only supports the standard implementation of pbkdf2.

A

ah So that's critical. Thank god.

A

Okay, now we can stop trying to do this.

A

Okay, well, there's that.

A

A

But can we go open ssl to open ssh.

B

Okay stage keychain just.

A

Not actually converted using this command, the key remains open, ssh format.

A

Okay, this is our problem.

A

Okay and then yeah, it doesn't like those asn 1 tags.

A

Okay, we'll need to support a new format for keys. I looked over and supporters unencrypted keys would be easy to do. Port encrypted key is a little harder right now. If you use pkcs8, it should work and you can create it using step or open. Ssl. Oh, is that that's this that step command.

A

Oh, this is great. The first command format, ssh look at this.

A

For ssh is unable to use the step generated key as a host key.

A

All ssh keys, created by step key ssh, okay,.

A

We may be able to use step.

A

I remember seeing this step thing ago.

A

Oh wow, thanks formatting out the window.

A

A

All right, so this is great, um so let's go ahead and copy this, let's figure out how to use this.

B

A

A

I think this thing, interior.

B

B

A

Sir, it's the server account for our testifies, use it to issue certificates, issue ssh, okay, yeah. I remember seeing this a while ago: yeah yeah, okay, um let's go grab it all right! Okay, so now we're actually gonna have a use for our our uh our um oh amd64. Look at that! No okay! No! No! Oh deb!

A

Okay! There we go tar, great okay! So let's go grab this thing and let's get if okay, okay, determined, open, ssl turned open. Ssl need to use step for format, conversion all right, so we determine we need to use.

A

A

Starting after this commit all right, these are terrible commitment messages, but I don't have a lot of time. um Okay, so.

A

Then um what are we uh cached, download, yeah, okay, so we're gonna. Do all this cash download stuff right same thing?

A

Okay, but now we're gonna, do it for step and we can verify it with cosine. Oh fun, look at that.

A

I can see how easy that's going to be.

B

A

A

Here we go paste. Okay, so we're gonna say we're just gonna throw those in here.

A

Download url download hash caster.

A

Oh, it's much better when these are split out. I don't want to run the auto formatter right now, though, usually we would, but I haven't been running it because I haven't had time to set it anything up. So once again one computer dies, the other computer dies, one computer. Does the other computer dies? It's like. I can't get one computer that won't die for more than five minutes. It feels like.

A

Okay, ssi service config; no longer you are now the step, ca, config, all right. Okay,.

A

Just don't see it done. Okay, there we go all right, um unexpected, indent, um okay. So let's see what is this all right, so download us service, download, step ca?

A

A

And so we're going to download cosine first and then we're going to do this command here or we're going to download cosign and then we're going to download.

A

All right so we're going to grab our shaw values and our urls, and let me change mage to.

A

So last time we were doing mage, but we're going to do. Mage is going to be cosine this time, because that's first and then mage is going to be step ca this time. Okay,.

A

And then we're going to run the cosine verify.

A

A

All right yeah, I added a bunch of tabs all right. I found replaced it my way. All right come on come on.

A

Let's take a deal: okay,.

A

All right download that all right, so this is our signature file, so we're going to need to download a signature file. Where is that? What is this dot? Sig? Okay, we've got sig urls here too, so then we're going to need our entity64.sig, so we're going to need cache download for that. So we have both cache download and cache.

A

Download unpack archive and cache download on pack archive really should take the cosign thing for the verification to go beyond just the shop, but it's okay before it extracts, because it auto extracts right now, but we'll tweak it okay so and then the same thing.

A

But oh well, I could have just deleted that. Couldn't I.

A

A

All right and what's the shot value of this, what's the shot value of this.

A

I don't know, let's find out.

A

ah There was a way to what is it.

A

There's a way to make them run command.

A

A

So you can run a command from vim. I found out about this recently right, so we can type um curl fso really set no paste pipe sha 384, some all right and we can say dot arrow arrow.

A

Left and then comma quote command.

A

Okay represents one.

A

Okay, so then this is bash.

A

Yes, okay, hell yeah, look at that! That was awesome! Okay, so then we can just take that okay, so we'll put that oh wow, that was sweet.

A

Now, if only we could make it async, huh that would be nice and we could go around and do these just all day.

A

Okay, yeah be nice if we could just do over the highlight of the line as well.

A

A

So we got these shots and these values- that's here and here.

A

And then here and here we have our signatures so for our signature file we can really just pass those directly and we'll say sig, we'll just say cache download, and this will give us the path to the file.

A

um Where does it download to, though, let's see.

A

B

A

So this is the location and.

A

So cached our drive.

A

A

And here we go: here's our signature, all right, so we downloaded it. We verified it and now we're going to download and verify.

A

B

A

Signature, okay, ca; okay, so that would be.

A

So step c, a archive path.

A

And we want to verify this archive path, um so we should say to do security.

A

Add in cosine validation during uh or before after download before.

A

Extract okay and let's see.

A

Okay, that looks like it's supposed to be a url.

B

A

So that says, run cosine and then we should say you know cosine, I'm assuming this is going to be cosine joint path, cosine, I'm assuming there's just a cosine binary within the download of the cosine download. So let's see what happens here and I think we can get rid of the rest of this.

A

B

A

Ca all right, so we download steps today and.

A

I think we basically yeah we aren't leaving any of that configurable, except for caster.

A

There we go we're just work to screw this. We don't have time for this.

B

A

Okay, because I know.

A

A

So cosine, hey s, bombs, great okay! You know all right. We don't have time for this cosine thing right now,.

A

We'll comment it out.

A

Okay, so let's yield this step, ca.

A

A

All right, okay, we're just gonna, pass!

A

I'm just going to pass this, I'm just going to hard code! This thing: okay, where uh how far are we even from doing this? Okay? Yeah? I can know we can do this. Okay,.

B

B

Come on come on come on.

B

Where are we okay, we're in implementation, cash down our path.

B

Expected: okay.

A

So, here, okay path; okay, we had a comma on the end of this line: okay and download archive one download.

B

A

I hope it doesn't blue screen on me. We downloaded one file. Okay,.

B

Jesus compressed data, okay, unknown archive format,.

B

Strips here, your uh path.

A

Just got mixed up foxes.

A

Okay, so now we've got step ca, downloaded.

A

Okay, so now we need to just use it. So what is.

A

So where is it so? It's in ben stepsia.join path or our club step ca.

A

A

All right so basically go through everything in here and look for the one that says you know, step ca.

A

A

Okay path, lab, oh path; okay,.

A

Okay, so we should have a handle on this thing now.

A

Okay, so the step ca, so let's go check out how we're supposed to run this thing.

A

A

A

So this should generate the host key. Okay.

A

A

Okay, so this will generate the key.

A

So we'll say basically, you know.

A

So split that and run um cell dot parent dot. uh What is called step ca?

A

A

A

Okay, so this one's going to return some data.

A

Okay, what was this error.

B

Where are we crypto? Okay, basically,.

B

A

Okay, that was a list, but it should have been. We have to return the first element and we have to do dot, resolve.

A

And now yeah we'll return the first element, because there should only be one and then we should say yeah. Let's see if I can execute that. Okay, uh too many positional arguments were provided to step ca. So.

A

Ssh key okay, but we copy pasted.

A

Damn, okay, all right I'll, be back.