| Network Working Group | P. Hallam-Baker |
| Internet-Draft | Comodo Group Inc. |
| Intended status: Informational | March 7, 2016 |
| Expires: September 8, 2016 |
Mathematical Mesh: Developer's Guide
draft-hallambaker-mesh-developer-01
The Mathematical Mesh 'The Mesh' is an end-to-end secure infrastructure that facilitates the exchange of configuration and credential data between multiple user devices.
This document describes how to install and run the Mesh reference code and make use of the reference code in applications. It does not form a part of the Mesh specifications and is not normative.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on September 8, 2016.
Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
The Mesh Reference library was developed using Visual Studio 2015 Community Edition using PHB's Build Tools extensions. The reference code itself is currently limited to C# libraries.
The code should in theory run under other operating systems but this is not currently tested.
Development under different development environments is also possible but would require re-engineering to make use of the line mode versions of the build tools.
Visual Studio 2015 Community Edition is currently available at no cost for a wide range of non-commercial development including personal use and development of Open Source software. For full details, please consult the license published by Microsoft.
https://www.visualstudio.com/
Over half the code in the reference code library is generated using code generators. These are used to ensure that the specification, examples and reference code are always kept in synchronization.
The build tools are published under an MIT License and are available in two forms:
As stand-alone tools to be run from the command line.
As a VSIX package that integrates into the Visual Studio environment.
The source distribution is configured to use the tools integrated into the Visual Studio environment. If development on other platforms is desired, the simplest approach is likely to be to write a tool that reads the Visual Studio configuration files and generates the corresponding files for use with make.
The VSIX package is available from the Visual Studio extensions gallery:
PHB Code Generation Tools
The source code for the build tools is available from:
https://sourceforge.net/projects/phb-build-tools/
The Mesh reference library source code is published under an MIT license and is available from:
https://sourceforge.net/projects/mathematicalmesh/
The reference code examples are designed to illustrate how the Mesh might be used in an application rather than be standalone tools in their own right. The Mesh is designed to make it each for developers to add security to their own applications rather than providing the applications themselves.
On the Windows platform, the server runs in the context of the platform Web server and must be granted permission to bind to the range of server addresses used using the netsh command.
From a command prompt with administrator privileges, run the following command:
netsh http add urlacl http://<domain>/.well-known/mmm/ \user=<machine>\<user>
Where is the DNS domain name under which the service is run, is the Windows domain name of the machine and the account name.
To start the service from the command line type:
servermesh <domain>
The server does not require administration privileges.
The profile manager wizard demonstrates functions that are performed on an administration device. These include creating a completely new profile and initial configuration of applications, connecting a device to the profile and recovery of the profile from escrow data.
To run the client from the command line, place the executable image in a location that it will be found in the PATH variable and type:
meshclient
The Profile connection wizard demonstrates the much more restricted functionality that would be required in a Mesh connected application and/or a profile manager for a non-administration device.
To run the client from the command line, place the executable image in a location that it will be found in the PATH variable and type:
meshconnect
All private key data is stored using the Windows public key store. At minimum, this ensures that private keys are obfuscated and encrypted under the account password to protect the data against casual extraction attacks. On a machine with cryptographic hardware support such as a TPM or HSM, extraction of the private key may be infeasible without physical access to the machine and possibly require sophisticated diagnostic equipment.
Separate settings are used for production and test code. Test Code should use the Registry Hive:
HKEY_CURRENT_USER\SOFTWARE\CryptoMesh
Production code should use the hive
HKEY_CURRENT_USER\SOFTWARE\MathematicalMesh
In either case the sub structure is:
The profile data itself is stored in data files at the location specified in the registry. The files are standard XML files in UTF8 encoding.
[[Not yet implemented, subject to change.]
All configuration information is stored in the user directory ~/.mmm
Keys are stored in SSH key file format [RFC4716] using the customary name and extension conventions for that application.
The application ExampleGenerator shows the use of the Mesh in an application using the convenience API. It is the application program used to generate the examples in the reference document.
ExampleGenerator implements a client that connects to a remote WebService, creates new personal profile with an escrow entry with offline recovery codes, attaches applications and other devices, updates an application profile, deletes all the profile data from the local machine and then restores them using the recovery codes and escrow entry.
The normal method of creating a Portal Client connection is?
Since the purpose of the ExampleGenerator is to create examples for the documentation, it is not necessary for the JSON Remote Procedure Calls to actually be 'Remote'. Instead the 'Local' Procedure Call mode is used in which the client and server both run in the same process with the client API invoking the server dispatch methods through an interface that performs JSON serialization and deserialization but does not invoke the network transport.
?.
For purposes of testing and initial development of a Web Service it is frequently desirable to further simplify the implementation by dispensing with the serialization layer and the client calling the server dispatch methods directly.
?.
If you are building Mesh applications in another language, the least effort approach may be to rewrite the PROTOGEN build tool to target your language.
Protogen does support generation of C header files that may be used to drive a parser. If however you are adding Mesh support for an application that already uses JSON based protocols, you might want to edit the generator scripting files to generate code for your existing libraries.
Security Considerations are addressed in the companion document [draft-hallambaker-mesh-architecture]
IANA Considerations are addressed in the companion document [draft-hallambaker-mesh-architecture]
Comodo Group: Egemen Tas, Melhi Abdulhayo?lu, Rob Stradling, Robin Alden.
| [RFC4716] | Galbraith, J. and R. Thayer, "The Secure Shell (SSH) Public Key File Format", RFC 4716, DOI 10.17487/RFC4716, November 2006. |
| [draft-hallambaker-mesh-architecture] | , , "[Reference Not Found!]" |