Re: [GNAP] Key Rotation

I do think it's important that a client instance should be able to rotate
its keys, as this is a pretty common practice in other related specs.

You mentioned pre-registered clients which I think is an interesting case.
I would expect in those cases the client instance wouldn't actually be
rotating its keys on its own, instead the developer/administrator would go
into the management console to rotate the keys there, and deploy the new
keys to the client instance, more like how typical OAuth clients work today.

Coming up with the actual rotation method is definitely an interesting
challenge, but there must be some prior art to draw from here. Wouldn't
existing specs like Mutual TLS or even PGP have some mechanism that could
be reused?

Aaron

On Tue, Jun 15, 2021 at 10:52 AM Justin Richer <jricher@mit.edu> wrote:

> In the GNAP protocol, most requests are bound to a key. There are pretty
> solid mechanisms for establishing those keys as part of the request, both
> dynamically and as part of some pre-registration step.
>
> However, over time those keys could be rotated out by the parties that
> control them, and GNAP needs to be able to handle this.
>
>         • Access tokens are bound to keys
>                 • We allow rotation of the token value at client instance
> request...
>                 • Should we allow rotation of the key also?
>         • Grant transactions are also bound to keys
>                 • Specifically: the continuation access token is bound to
> a key
>                 • The key is initially the client instance’s key
>                 • Should the client be able to rotate this key separately?
>         • Some client instances have registered keys
>                 • What happens when a client’s registered key rotates?
>
>
> Secure rotation of a key would require some way for the presenter to prove
> possession of both the old and new keys simultaneously. It could be a
> matter of signing the request with the new key and include some artifact
> signed by the old key in the request, or the inverse of that. There are
> likely other methods out there, but this seems simplest.
>
> What situations are people looking at for handling key rotation?
>
>  — Justin
> --
> TXAuth mailing list
> TXAuth@ietf.org
> https://www.ietf.org/mailman/listinfo/txauth
>