search

ietf-wg-gnap / gnap-core-protocol

146 stars 26 forks source link

delay for previous_key #456

Closed fimbault closed 2 years ago

fimbault commented 2 years ago

from @adeinega "am I right that previous_key becomes immediately invalid? If it's true, wouldn't be nice to have here some way to rotate them more or less gracefully? It could be useful when there are multiple running instances of the client and it's tough, or even impossible, to update the keys on all these instances immediately (just as an example, the client instance could be deployed as a service in K8S)."

We'll handle this via a (non normative) security consideration

adeinega commented 2 years ago

https://github.com/ietf-wg-gnap/gnap-core-protocol/pull/457 looks good, thank both of you.

There was one thing more, an AS may not always allow its client instances to rotate the keys, correct? Therefore,

  1. the client instances might "learn" whether it's possible in advance, during ongoing negotiation with the AS
  2. the specification may define a dedicated error that will basically tell the client instances, this operation isn't allowed