Recovery keys about acme-spec

[bifurcation]

+1 to the desire to have everything in the Authorization be public.

IIRC, Eckersley and Schoen were sanguine about recoveryTokens. But maybe
now that we have the recoveryContact method, we can get rid of
recoveryToken? I'll see if I can get them to chime in.

If we choose to keep the recoveryToken facility around, your scheme looks
pretty good to me. I would actually just use JWS again, but with alg=HS*.
Have the client's request include a JWS with a detached signature over the
request body. The processing would be something like:

Input: ACME authorization

1. Serialize authz to JSON/UTF-8
2. Compute "recoveryValue" == JWS("HS256", recoveryToken,
   serializedAuthz).SerializeCompact().Detach()
3. Add a "recoveryValue" protected parameter to the outer JWS
4. Compute the JWS wrapper for the overall signature.

These recoveryValues would not be very long, just (length of hash) +
(length of base64url-encoded protected header) + 2. For example:
eyJhbGciOiJIUzI1NiIsImtpZCI6IjIifQ..hSVV5XiBDjWiM2bvkvoNyaJYsNL65IcIEnUitDXdF1Y

On Mon, Dec 22, 2014 at 1:58 PM, Martin Thomson [email protected]
wrote:

I noted this when reviewing #48
#48. I think that this
needs a better design, since it would be good if the information hosted in
the authorization resource could be all completely public.

If the design of the recovery keys is such that they could be used just
once (and I think that's probably fair), then you don't need to worry about
redacting anything.

Clients create an authorization resource with a recovery key by adding a
"recoveryKey" challenge when they request that the resource be created.
This includes a hash value:

hash = HMAC(recoveryKey, 'acme-recovery\0' || identity.type.length || identity.type || identity.value.length || identity.value)

(I'm not sure what sort of HMAC discriminator you might want to use
throughout, so details can vary.)

If a client wants to use the recovery key, it provides the value of
recoveryKey.

Now, to the separate question of why it might want to have this capability
at all...

—
Reply to this email directly or view it on GitHub
#50.

[bifurcation]

I think this has been rendered moot by recent changes to the authz/registration objects.