|
1 | | -# fpki |
| 1 | +# FPKI |
| 2 | + |
| 3 | +## Features |
| 4 | + |
| 5 | +- Issuance and logging of RPC (Root Policy Certificate) |
| 6 | +- Issuance of SPT (Signed Policy Certificate) using RPC |
| 7 | +- Verification of RPC using SPT |
| 8 | +- Consistency verification of the log |
| 9 | + |
| 10 | +## Dir structure |
| 11 | + |
| 12 | + . |
| 13 | + ├── cert # certificates for testing. Eg. cert for PCA |
| 14 | + ├── cmd # Executables. Log server and log signer |
| 15 | + ├── config # Config file for PCA and policy log |
| 16 | + ├── doc # FPKI design |
| 17 | + │ ├── images |
| 18 | + │ └── performance_test_output # Some results of the policy log performance |
| 19 | + ├── pkg # Packages of the project |
| 20 | + ├── scripts # Scripts to clean and build the executables |
| 21 | + └── tests # Some intergration tests. Unit tests are in the individual pkg |
| 22 | + |
| 23 | + |
| 24 | + ## Overview |
| 25 | + ![Alt text](doc/images/overview.png?raw=true"Overview") |
| 26 | + |
| 27 | + The figure above illustrates the components so far. The domain owner sends RCSR to the PCA, and PCA signs the RCSR to generate an RPC. Then the PCA sends the RPC to the policy log to get an SPT. The log verifier will verify the SPT and the consistency between the old tree head and the newest tree head. |
| 28 | + |
| 29 | + ### Policy log |
| 30 | + Trillian is used in the policy log. |
| 31 | + |
| 32 | + The policy log is the most complex component so far. It consists of four sub-components: |
| 33 | + - **(Log server)** Log server is responsible for receiving and sending responses. However, it does not generate proof of inclusion. It is similar to a user interface, which handles the RPC request and distributes the result. |
| 34 | + - **(Log signer)** Log signer is responsible for adding the new leaves, generating the new tree head, and the proof of inclusion for every added leaf. |
| 35 | + - **(Log client)** Log client is responsible for sending the new leaves to the log server and retrieving information from the log server. |
| 36 | + - **(Admin client)** Admin client is responsible for managing trees in the log server. For example, create a new tree or delete an existing tree. |
| 37 | + |
| 38 | +Within the policy log, the log client and admin client only communicate with the log server via grpc. Log signer only communicates with the log server, and the communication is internal, so we don't have access to it. For other components outside the policy log, they can only have access to the log client to add leaves of fetch proof of inclusion. Admin client should only be accessed internally. |
| 39 | + |
| 40 | +## How to run the integration tests |
| 41 | +There are two integration tests which require the setup of Trillian server. |
| 42 | + |
| 43 | +Download trillian and setup database (more information on https://github.com/google/trillian#mysql-setup) |
| 44 | +``` |
| 45 | +git clone https://github.com/google/trillian.git |
| 46 | +cd scripts |
| 47 | +./resetdb.sh |
| 48 | +``` |
| 49 | +Download the FPKI |
| 50 | + |
| 51 | +Conpile the executable |
| 52 | + ``` |
| 53 | + make |
| 54 | + make test_folders |
| 55 | + ``` |
| 56 | + |
| 57 | + Open two terminals, run "cmd/logserver_exec" and "cmd/logsigner_exec" |
| 58 | + |
| 59 | + Run the tests: |
| 60 | + ``` |
| 61 | + cd fpki |
| 62 | + go test ./... |
| 63 | + ``` |
| 64 | + |
| 65 | + |
| 66 | + |
| 67 | + |
| 68 | + |
0 commit comments