Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Keirthana T S <[email protected]>
  • Loading branch information
morphis and keirthana authored Aug 28, 2024
1 parent f17feed commit d55e349
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions explanation/cryptography/crypto_stream_gateway.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,15 @@ Anbox Streaming Gateway is using cryptographic technology for:

## TLS transport encryption

All network endpoints exposed by the Anbox Stream Gateway are secured with TLS using an 4096 bit RSA key. The Anbox Stream Gateway strictly enforces TLS 1.3 or better and does not provide backward compatibility with older TLS versions.
All network endpoints exposed by the Anbox Stream Gateway are secured with TLS using an 4096 bit RSA key. The Anbox Stream Gateway strictly enforces TLS 1.3 or later and does not provide backward compatibility with older TLS versions.

## Mutual TLS based authentication

In order to exchange messages with the Anbox Stream Agent through the [NATS](https://nats.io/) message queue, the Anbox Stream Gateway uses a CA certificated signed by a 4096 bit RSA key to ensure trust with the NATS server.
To exchange messages with the Anbox Stream Agent through the [NATS](https://nats.io/) message queue, the Anbox Stream Gateway uses a CA certificate signed by a 4096 bit RSA key to ensure trust with the NATS server.

## Token based authentication

Users can generate API tokens to authenticate with the HTTP API provided by the Anbox Stream Gateway. For the API tokens a scope-limited [Macaroon](http://theory.stanford.edu/~ataly/Papers/macaroons.pdf) is used. The token is signed with a [HMAC](https://www.okta.com/identity-101/hmac/) using SHA-256 (HS256) and a 64 byte secret key. The [`macaroon.New`](https://pkg.go.dev/gopkg.in/[email protected]#New) method is used internally to generate the JWT token.
Users can generate API tokens to authenticate with the HTTP API provided by the Anbox Stream Gateway. For the API tokens, a scope-limited [Macaroon](http://theory.stanford.edu/~ataly/Papers/macaroons.pdf) is used. The token is signed with a [HMAC](https://www.okta.com/identity-101/hmac/) using SHA-256 (HS256) and a 64 byte secret key. The [`macaroon.New`](https://pkg.go.dev/gopkg.in/[email protected]#New) method is used internally to generate the [JWT](https://jwt.io/) token.

## Packages used

Expand Down

0 comments on commit d55e349

Please sign in to comment.