<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Guillaume - Thank you so much. A few questions...</div><div><br></div><div>Who needs to review this documentation?</div><div><br></div><div>Where should it be posted in relation to our Apps Security documentation? </div><div><a href="https://wiki.mozilla.org/Apps/Security">https://wiki.mozilla.org/Apps/Security</a></div><div><br></div><div><br></div><div>Did / Does this close a bug in our bug list?</div><div><a href="https://bugzilla.mozilla.org/show_bug.cgi?id=packaged-apps">https://bugzilla.mozilla.org/show_bug.cgi?id=packaged-apps</a></div><div><br></div><div>thanks muchlY!!!</div><br><div apple-content-edited="true">
<div>~ pmpcat</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br><div><div>On Dec 20, 2012, at 3:42 PM, Guillaume Destuynder wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>TL;DR:<br><a href="https://mana.mozilla.org/wiki/display/SECURITY/HSM+Policy">https://mana.mozilla.org/wiki/display/SECURITY/HSM+Policy</a><br>https://mana.mozilla.org/wiki/display/SECURITY/HSM+Operational+Procedures<br><br>Hi,<br><br>the documents are available at:<br><br>1) HSM Policy: https://mana.mozilla.org/wiki/display/SECURITY/HSM+Policy<br>This is the document that details the handling, processes, etc. around<br>the HSM. There are a couple of note sections regarding the App Signing<br>and Receipt Signing paragraphs as those need more input, in particular:<br><br>- OCS quorum is required to generate new keys<br>- The root CA, in our etherpad design, is hosted on an offline HSM host<br>(ie no network access, no updates, etc.)<br>Such a machine can have the same requirements as regular HSM hosts<br>(secure data center, logged physical access, backup procedures, etc.)<br>but fall in a different system security zone and have no network<br>security zone.<br>The signing process has to be also detailed in this case, I would<br>suggest that the OCS quorum should be identical to the ACS quorum with<br>the same card holders, as having a different set of people would make<br>things too complex and unrealistic.<br><br>2) HSM operational procedures:<br>https://mana.mozilla.org/wiki/display/SECURITY/HSM+Operational+Procedures<br>This is the document that details the actual commands and physical<br>switches to use on the HSM for common operations (new security world,<br>import a world, generate card sets, generate keys, etc.).<br><br>We can go into more technical details were necessary in that document.<br><br>Note that none of the documents cover directly the actual Mozilla APIs<br>running on top of the HSM, such as the unison service, or a possible<br>push implementation of that service (as Ben Adida mentionned, having the<br>HSM connect to the machines where signing is necessary allow us to avoid<br>having a service listening on the HSM itself). I believe this should be<br>discussed as well in the separate thread Ben mentionned.<br><br>Any feedback, improvements, etc. are welcome.<br><br>Many thanks!<br><br>Guillaume<br><br>Last note: I am currently in the CEST timezone (Paris), this may delay<br>some of my replies to anyone in or near PDT.<br><br>On 12/19/12 21:28, Ben Adida wrote:<br><blockquote type="cite">On 12/19/12 9:42 AM, Raymond Forbes wrote:<br></blockquote><blockquote type="cite"><blockquote type="cite">I am ok with your proposal as long as we can manage our keys as securely<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">as possible while waiting to utilize the HSM.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I agree that the production secret key should never leave the HSM in raw<br></blockquote><blockquote type="cite">form.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">We do have some documentation on key creation, backing up and storing<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">but not as complete as we would like. Guillaume will complete this doc<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">and will send out a draft tomorrow.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Great, I think that will be very useful. We need to specifically design<br></blockquote><blockquote type="cite">the people-process around the root key generation. Who should be there,<br></blockquote><blockquote type="cite">who operates the machine, etc. There is a tremendous amount of trust<br></blockquote><blockquote type="cite">that needs to be placed in that process.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite"><blockquote type="cite">As far as number 4. I would like to hear more of what you are thinking.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"> The etherpad that I created I believe addresses some of these issues.<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite"> I would be happy to discuss this further or would welcome feedback on<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">the document.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Let me follow this up in a separate thread to make it easier to discuss.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">-Ben<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">_______________________________________________<br></blockquote><blockquote type="cite">Packagedapps mailing list<br></blockquote><blockquote type="cite">Packagedapps@mozilla.org<br></blockquote><blockquote type="cite">https://mail.mozilla.org/listinfo/packagedapps<br></blockquote>_______________________________________________<br>Packagedapps mailing list<br>Packagedapps@mozilla.org<br>https://mail.mozilla.org/listinfo/packagedapps<br></div></blockquote></div><br></body></html>