| Excerpt |
|---|
The Keyservice is service for creating, storing and accessing 128 bit keys. The keys issued by the service are meant for encrypting users Refresh Token and/ or Client Credentials obtained from a successful login flow. |
The Keyservice is service for creating, storing and accessing 128 bit keys. The keys issued by the service are meant for encrypting users Refresh Token and/ or Client Credentials obtained from a successful login flow, in order to store the tokens securely on a device, in way that leaves accessing the tokens by brute force attacks infeasible.
The service exposes the following endpoints for creating and accessing keys:
createKey - create a 128 bit key from a user chosen password
getKey - access a key from a key ID and password
getLongKey - acesss a key from a key ID and long secret
and the following endpoints for maintaining keys:
getDevices - list keys associated with a user
deleteDevices - delete a key associated with a key ID
Motivation
If an attacker obtained a users Refresh Token, the person could exchange the token for an Access Token (AT) from the Authorization Server, and maliciously act as the user. Therefore the Refresh Token (RT) needs to be stored securely on a users device. A naive approach is to encrypt the Refresh Token with a user chosen password. This password is usually vulnerable to brute force attacks. Therefore, we encrypt the Refresh Token with a 128 bit key, which the user can access from a web service, in such a way, that the service locks the key, if numerous invalid attempts are made at accessing the key. Thus leaving brute force attacks on getting access to the key infeasible.
...
The following diagram illustrates how an app obtains a valid set of tokens and client credentials from an Authorization Server (Keycloak), creates a key on the Keyservice for encrypting and securely storing the client credentials and RT on a users device, and successfully uses the AT for interacting with the FUT infrastructure..jpg?version=1&modificationDate=1571669027373&cacheVersion=1&api=v2&height=400)
...
The user can now access the key and decrypt the User Credentials and Refresh Token, by interacting with the Keyservice:.jpg?version=1&modificationDate=1571669188549&cacheVersion=1&api=v2&height=400)
...
Or by authenticating using bio-metrics on a mobile device, and decrypt the Client Credentials and Refresh Token using the long secret:.jpg?version=1&modificationDate=1571669422766&cacheVersion=1&api=v2&height=400)
...
Keyservice management
There are 2 types of management,
...