mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-09-20 00:06:21 +00:00
9a1f52e94e
So far the masterSecret was sent to the initial bootstrapper on init/recovery. With this commit this information is encoded in the kmsURI that is sent during init. For recover, the communication with the recoveryserver is changed. Before a streaming gRPC call was used to exchanges UUID for measurementSecret and state disk key. Now a standard gRPC is made that includes the same kmsURI & storageURI that are sent during init.
25 lines
717 B
Go
25 lines
717 B
Go
/*
|
|
Copyright (c) Edgeless Systems GmbH
|
|
|
|
SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
package attestation
|
|
|
|
import (
|
|
"github.com/edgelesssys/constellation/v2/internal/crypto"
|
|
)
|
|
|
|
const (
|
|
// clusterIDContext is the value to use for info when deriving the cluster ID.
|
|
clusterIDContext = "clusterID"
|
|
// MeasurementSecretContext is the value to use for info
|
|
// when deriving the measurement secret from the master secret.
|
|
MeasurementSecretContext = "measurementSecret"
|
|
)
|
|
|
|
// DeriveClusterID derives the cluster ID from a salt and secret value.
|
|
func DeriveClusterID(secret, salt []byte) ([]byte, error) {
|
|
return crypto.DeriveKey(secret, salt, []byte(crypto.DEKPrefix+clusterIDContext), crypto.DerivedKeyLengthDefault)
|
|
}
|