From 19ab117a6c33d3ea2eed96159fda265b414b0ea1 Mon Sep 17 00:00:00 2001 From: Simon Fels Date: Tue, 27 Aug 2024 22:37:50 +0200 Subject: [PATCH] feat: add crypto explanation for the stream gateway --- .../cryptography/crypto_stream_gateway.md | 25 +++++++++++++++++++ explanation/cryptography/landing.md | 1 + 2 files changed, 26 insertions(+) create mode 100644 explanation/cryptography/crypto_stream_gateway.md diff --git a/explanation/cryptography/crypto_stream_gateway.md b/explanation/cryptography/crypto_stream_gateway.md new file mode 100644 index 00000000..0468549a --- /dev/null +++ b/explanation/cryptography/crypto_stream_gateway.md @@ -0,0 +1,25 @@ +(exp-security-crypto-stream-gateway)= +# Anbox Stream Gateway + +Anbox Streaming Gateway is using cryptographic technology for: + +* TLS transport encryption +* Mutual TLS based authentication +* Token based authentication + +## TLS transport encryption + +All network endpoints exposed by the Anbox Stream Gateway are secured with TLS using an 4096 bit RSA key. The Anbox Stream Gateway strictly enforces TLS 1.3 or later and does not provide backward compatibility with older TLS versions. + +## Mutual TLS based authentication + +To exchange messages with the Anbox Stream Agent through the [NATS](https://nats.io/) message queue, the Anbox Stream Gateway uses a CA certificate signed by a 4096 bit RSA key to ensure trust with the NATS server. + +## Token based authentication + +Users can generate API tokens to authenticate with the HTTP API provided by the Anbox Stream Gateway. For the API tokens, a scope-limited [Macaroon](http://theory.stanford.edu/~ataly/Papers/macaroons.pdf) is used. The token is signed with a [HMAC](https://www.okta.com/identity-101/hmac/) using SHA-256 (HS256) and a 64 byte secret key. The [`macaroon.New`](https://pkg.go.dev/gopkg.in/macaroon.v2@v2.1.0#New) method is used internally to generate the [JWT](https://jwt.io/) token. + +## Packages used + +* [Go standard library](https://pkg.go.dev/std) +* [`gopkg.in/macaroon.v2`](gopkg.in/macaroon.v2) diff --git a/explanation/cryptography/landing.md b/explanation/cryptography/landing.md index f77f1a6a..7a1570c9 100644 --- a/explanation/cryptography/landing.md +++ b/explanation/cryptography/landing.md @@ -11,5 +11,6 @@ This information is currently available for the following components: crypto_ams crypto_stream_agent +crypto_stream_gateway crypto_dashboard ``` \ No newline at end of file