OpCert counters
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
Research direction
Start with the context in issue #32 and the current KES Agent handling of OpCert serial numbers and opcert.counter. Clarify the security scenario for rejecting gaps, recovery after an incorrect or compromised certificate, and missed uploads in self-healing networks; done means the behavior and reset or recovery approach are agreed and documented.
Written by the indexing model from the issue text.
Description
Split off from #32
OpCerts should be rejected when their serial number does not match the next serial number in sequence.
Currently, KES Agent only rejects opcerts whose serial numbers are the same or lower than the current one, and it does not track serial numbers itself. This means that when a KES Agent restarts, it will accept any OpCert (provided the signature checks out), and it will always accept OpCerts whose serial number is higher than that of the one it currently holds.
Clarify:
- What exactly is the scenario against which exact serial number checks defend? (That is, why is it important to not only check that no serial number has been used twice, but also that there are no gaps in the sequence of serial numbers?)
- How do we currently handle the situation where a user has generated an incorrect/compromised OpCert, and needs to generate a new one without installing the incorrect one? This would require resetting the OpCert counter (
opcert.counter), but AFAICT, there is no straightforward way of doing that. - How are we going to handle a situation where multiple KES agents are running in a self-healing network, and one of them misses a key upload due to being unavailable for a long enough amount of time?
- Dominant language
- Haskell
- Stars
- 2
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from IntersectMBO/kes-agent
-
Difficulty 4/5 3-5 days Newbie friendliness 30/100
IntersectMBO/kes-agent#109 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 52/100
IntersectMBO/kes-agent#102 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
IntersectMBO/kes-agent#79 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
IntersectMBO/kes-agent#78 · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
IntersectMBO/kes-agent#70 ·
All issues in IntersectMBO/kes-agent
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 75/100
-
15-minutes 5-minutes algorithm any-language beginner-friendly c cpp csharp easy go good first issue hacktoberfest help wanted java javascript kotlin python rust swift typescript
Difficulty 1/5 Under an hour Newbie friendliness 68/100
Huerte/algo-solutions-python#260 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
IntersectMBO/cardano-ledger#6276 ·
Maintainers usually reply within 1 day