search

crypto-com / thaler

Thaler Experimental Network; For Crypto.org Chain: github.com/crypto-org-chain/chain-main
https://thaler-testnet.crypto.com
Other
158 stars 80 forks source link

Problem: client-* breaks PoLP #1491

Open tomtau opened 4 years ago

tomtau commented 4 years ago

Currently, no matter what action is being done, client internals allow accessing or doing anything -- e.g. if one wants to only read the balance or history, one could easily grab the private keys for spending at that moment -- which breaks PoLP. One start could be adding capabilities to seckey: https://github.com/crypto-com/chain/blob/master/client-common/src/seckey.rs#L14

yihuang commented 4 years ago

Aren't we using the same encryption key for all the data currently? Maybe use a different encryption key for spending key?

tomtau commented 4 years ago

Aren't we using the same encryption key for all the data currently? Maybe use a different encryption key for spending key?

yeah, that will be the second step. the first step may be to add the capabilities to seckey (make the current seckey to have all capabilities) and mark different internal APIs what capability they require (it may be a big change, so can be a PR on its own). the second step will be to derive multiple keys

tomtau commented 4 years ago

one potential thing to look into: https://github.com/casbin/casbin-rs

tomtau commented 4 years ago

examples: https://web.archive.org/web/20180129173236/http://zsck.co/writing/capability-based-apis.html https://docs.rs/secp256k1/0.17.2/secp256k1/#enums

hsluoyz commented 4 years ago

Hi @tomtau I'm from Casbin team. Casbin is a very popular authorization library in Go (https://casbin.org/) and we have ported it to Rust: https://github.com/casbin/casbin-rs (which is 2x faster). It supports classic access control models like ACL, RBAC, ABAC, RESTful, etc. Please have a try with it and let me know if you have any questions.

tomtau commented 4 years ago

Hi @hsluoyz , thanks! Casbin is very nice, but it may be an overkill here (a simple command line interface or rpc application) -- maybe some basic mode without users could work. ideally, we would also want to separate out internals on the type level as in https://github.com/crypto-com/chain/issues/1491#issuecomment-665554430 -- we'd probably start with that, see how it evolves and whether it'd make sense to add this sort of authorization middleware later