Gamedev Mastodon

0 posts0 participants0 posts today

Sharon GoldbergNew highly nerdy and awesome blog on <a href="https://infosec.exchange/tags/openpubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpubkey</a> and <a href="https://infosec.exchange/tags/cryptography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptography</a> <a href="https://www.bastionzero.com/blog/generalizing-openpubkey-to-any-identity-provider" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bastionzero.com/blog/generalizing-openpubkey-to-any-identity-provider</a>

Sharon GoldbergMonster <a href="https://infosec.exchange/tags/OpenPubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPubkey</a> release from <a href="https://hexagon.space/@ethan_heilman" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ethan_heilman</a> and the team at BastionZero and <a href="https://techhub.social/@docker" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@docker</a> today. <a href="https://www.bastionzero.com/blog/announcing-the-release-of-openpubkey-v0-3-0" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bastionzero.com/blog/announcing-the-release-of-openpubkey-v0-3-0</a>

Sharon GoldbergExcited to share a new IETF internet draft that <a href="https://mstdn.social/@bifurcation" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bifurcation</a> and I just submitted to the OAuth working group. We introduce PIKA: Proof of Issue Key Authority, to solve a problem relevant to <a href="https://infosec.exchange/tags/openpubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpubkey</a>, <a href="https://infosec.exchange/tags/oidc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#oidc</a> and JWTs in general. What's a PIKA and why do I care? OpenPubkey uses PK Tokens to allow an OpenID Provider (OP) to bind user identities to user-held public keys. This essentially allows the OP to act like a certificate authority, without any changes to today's OIDC.PK Tokens are signed by the OP's signing keys. But, OP's rotate their signing keys over time. What happens if we need to use a PK Token *after* the OP rotates signing key? This is where the PIKA comes in. In this draft, we introduce the PIKA and show how it can be combined with a timestamping authority to allow PK Tokens to be used even after the OP rotates it signing key. The PIKA is a secure object that allows you to cache the OP's key, and verify using the OP's key even if the OP is offline. And that's why I got interested in this work. But our solution is much more generic and widely applicable than to just OpenPubkey. PIKAs allow the verification of JWTs, ID Tokens and other OIDC Tokens without querying the OP directly. You can use them to reduce the load on a OP, or to build applications that require caching or historical information about OP keys. Historical information about signing key is a particularly important in <a href="https://infosec.exchange/tags/softwaresupplychain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#softwaresupplychain</a> usecases.We're still digesting all the different ways that PIKAs can be used. Feel free to get in touch if you have any feedback!<a href="https://www.ietf.org/archive/id/draft-barnes-oauth-pika-00.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.ietf.org/archive/id/draft-barnes-oauth-pika-00.html</a>

Ethan HeilmanExcellent program at <a href="https://infosec.exchange/@BSidesCambridgeMA" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@BSidesCambridgeMA</a> today.Excited to present <a href="https://hexagon.space/tags/OpenPubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPubkey</a> and demo how to ssh using your OpenID identity without having to trust your identity provider.HMU if you are at bsides today

fenix<a href="https://mastodon.uno/tags/UnoLinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UnoLinux</a> <a href="https://mastodon.uno/tags/linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#linux</a> <a href="https://mastodon.uno/tags/openpubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#openpubkey</a> OpenPubKey, un nuovo protocollo crittografico open-source di BastionZero per zero-trust e autenticazioni senza password <a href="https://www.laseroffice.it/blog/2023/10/27/openpubkey-un-nuovo-protocollo-crittografico-open-source-di-bastionzero-per-zero-trust-e-autenticazioni-senza-password/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.laseroffice.it/blog/2023/10/27/openpubkey-un-nuovo-protocollo-crittografico-open-source-di-bastionzero-per-zero-trust-e-autenticazioni-senza-password/</a>

Ethan HeilmanJust dropped our paper on eprint: OpenPubkey. I welcome any questions/feedback replies<a href="https://hexagon.space/tags/OpenPubkey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenPubkey</a> adds user-held public keys into OpenID Connect without breaking compatibility. This means users can create digital signatures on the web that are associated with their ID Tokens. Fully signed APIs here we come.Our protocol is so compatible with existing IDPs that not only have we been using it in production with Google, Okta, and Microsoft IDPs for over a year, but that IDPs can't even tell that OpenPubkey is being used!<a href="https://hexagon.space/tags/OIDC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OIDC</a> <a href="https://hexagon.space/tags/JSON" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JSON</a> <a href="https://hexagon.space/tags/JWS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JWS</a> <a href="https://hexagon.space/tags/websec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#websec</a><a href="https://eprint.iacr.org/2023/296.pdf" rel="nofollow noopener noreferrer" target="_blank">https://eprint.iacr.org/2023/296.pdf</a>

Recent searches

Search options

Administered by:

Server stats:

#openpubkey