CDNI Protected Secrets Metadata

3.1. MI.SecretStore

MI.SecretStore instructs the counterparty how to dereference the value of any MI.SecretValue objects linked to the store.¶

For embedded stores, MI.SecretStore identifies the certificate used for encrypting the values. For external stores (e.g., HashiCorp Vault), MI.SecretStore specifies the service endpoint that should be used in conjunction with the MI.SecretValue key path to obtain the secure data.¶

• Property: secret-store-id¶

  • Description: A unique identifier for this store configuration that is referenced from linked MI.SecretValue objects.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

• Property: secret-store-type¶

  • Description: A type discriminator for the configuration object, this property specifies whether the linked MI.SecretValue objects contain embedded secret objects or reference an external store.¶
  • Type: String. Either MI.SecretStoreTypeEmbedded or MI.SecretStoreTypeVault.¶
  • Mandatory-to-Specify: Yes¶

• Property: secret-store-config¶

  • Description: The appropriate configuration object for the specified store type.¶
  • Type: Specified by the secret-store-type property.¶
  • Mandatory-to-Specify: Yes¶

• Property: secret-certificate-id¶

  • Description: The ID of the MI.SecretStoreCertificate used to encrypt secret messages linked with this store configuration. Used only in the case of MI.SecretStoreTypeEmbedded.¶
  • Type: String¶
  • Mandatory-to-Specify: No¶

The following is an example of MI.SecretStore:¶

{
  "secret-store-id": "store-1",
  "secret-store-type": "MI.SecretStoreTypeEmbedded",
  "secret-store-config": {
       "format": "cms"
  }
}

3.2. MI.SecretStoreTypeEmbedded

MI.SecretStoreTypeEmbedded contains the configuration necessary to decrypt embedded secrets in MI.SecretValue.¶

The only currently supported encrypted message format is Cryptographic Message Syntax (CMS) as defined in [RFC5652]. Messages MUST be CMS type "EnvelopedData" and Base64 encoded.¶

A cleartext format is also defined for testing purposes. In this case, the value of an MI.SecretValue object's secret-value property is the cleartext secret.¶

• Property: format¶

  • Description: The format of the embedded encrypted message.¶
  • Type: String. Either "cms" or "cleartext".¶
  • Mandatory-to-Specify: Yes¶

The following is an example of MI.SecretStoreTypeEmbedded specifying use of CMS:¶

{
  "secret-store-id": "store-1",
  "secret-store-type": "MI.SecretStoreTypeEmbedded",
  "secret-store-config": {
      "format": "cms"
  }
}

3.3. MI.SecretStoreTypeVault

MI.SecretStoreTypeVault contains the configuration necessary to reference secrets stored in an external instance of a HashiCorp Vault KV store.¶

MI.SecretValue objects reference secrets stored in the Vault using the secret-path property to identify the path and property key. See the MI.SecretValue section for details.¶

• Property: endpoint¶

  • Description: The base URL of the Vault instance.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

• Property: namespace¶

  • Description: The Vault namespace in which secret lookups should be performed.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

• Property: version¶

  • Description: The Vault KV version.¶
  • Type: Integer. Valid values: 1 or 2.¶
  • Mandatory-to-Specify: Yes¶

The following is an example of MI.SecretStoreTypeVault specifying a version KV-V1 Vault:¶

{
  "secret-store-id": "store-2-vaultv1",
  "secret-store-type": "MI.SecretStoreTypeVault",
  "secret-store-config": {
      "endpoint": "https://vault.example.com/v1/secret",
      "version": 1,
      "namespace": "customer-1"
  }
}

The following is an example of MI.SecretStoreTypeVault specifying a version KV-V2 Vault:¶

{
  "secret-store-id": "store-3-vaultv2",
  "secret-store-type": "MI.SecretStoreTypeVault",
  "secret-store-config": {
      "endpoint": "https://vault.example.com/v1/secret",
      "version": 2,
      "namespace": "customer-1"
  }
}

3.4. MI.SecretValue

MI.SecretValue may be used in any FCI or MI object where sensitive data must be transmitted only to intended recipients.¶

• Property: secret-store-id¶

  • Description: The linked MI.SecretStore that contains the configuration defining how to decrypt or access the referenced secret.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

• Property: secret-value¶

  • Description: Used only for embedded secrets, the Base64 encoded value of a CMS message or the cleartext string, depending on the defined MI.SecretStore configuration.¶
  • Type: String¶
  • Mandatory-to-Specify: No¶

• Property: secret-path¶

  • Description: Used only for HashiCorp Vault secrets, the path, not including namespace, to the secret, including the key of the particular property to access as the last path parameter.¶
  • Type: String¶
  • Mandatory-to-Specify: No¶

• Property: timeout¶

  • Description: If this property is present and the elapsed time since last retrieving the secret value has exceeded the specified duration, any cached instance of this secret value should be discarded and fetched again from the associated secret store.¶
  • Type: Integer duration in seconds.¶
  • Mandatory-to-Specify: No¶

The following is an example of MI.SecretValue specifying an embedded value:¶

{
  "secret-store-id": "store-1-cms",
  "secret-value": "MIIBiQYJKoZIhvcNAQcDoIIBejCCAXYCAQAxggEhMIIBHQIBAD
AFMAACAQEwDQYJKoZIhvcNAQEBBQAEggEApJeXzsUS1jbAyNtQiJ9um9IMIHW5B2g+gHn
XdNSTyd33OEfTR6yLSZihBlFbHpY3qSzK1CX7RF5Oz3SqLDW+r3i1D/aHbVXwQbviWHEv
Hterql8l9VDm2FCNaDx5vihdbtvng3+/vdJNNMMhmovwZL5uhPsK81DkKwZCvznMMWt8Y
dNSFGT62f73ash7Eg/mS54IUyYOJHYrXEkRLSjvl0j+JqcIR8hCOCA78+5bS4MgfdsS9x
xSwQTrPru6EdTivMDKE/jlKg7li8lWdirWqtv0za5gLmH5T+zslXIoklwERAE50Jj8FxZ
D98EikKH8DAa+JeFsBm6Z1+yVFsWucTBMBgkqhkiG9w0BBwEwHQYJYIZIAWUDBAEqBBBw
s1riXA6m336zRbsiKtrVgCA267133v2zD/wjFQHXrKSJfd/2YJaxPskgdmQaVlgWCw=="
}

The following is an example of MI.SecretValue for a Vault:¶

{
  "secret-store-id": "store-2-vaultv1",
  "secret-path": "bar/baz/importantsecret",
  "timeout": 3600,
}

3.5. MI.SecretCertificate

MI.SecretCertificate is used to share an [X.509] certificate to be utilized for encrypting embedded secret messages.¶

In lab and testing environments, this certificate MAY be self-signed, depending on participant agreement.¶

In production environments, this SHOULD be a certificate signed by an appropriate certificate authority (CA)and validated by the counterparty.¶

• Property: certificate-id¶

  • Description: A unique ID for this certificate that can be referenced from a corresponding MI.SecretStore configuration defined by a counterparty.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

• Property: certificate-value¶

  • Description: The Base64 encoded certificate.¶
  • Type: String¶
  • Mandatory-to-Specify: Yes¶

The following is an example of MI.SecretCertificate:¶

{
  "certificate-id": "store-1",
  "certificate-value": "MIIDZTCCAk2gAwIBAgIUFJokJzAxDgUGsBd8uhSblpMwS
LAwDQYJKoZIhvcNAQELBQAwQjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3JnaWExIT
AfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzAxMjMyMDM2MDNaFw0
yMzAyMjIyMDM2MDNaMEIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdHZW9yZ2lhMSEwHwYD
VQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQUAA4IBD
wAwggEKAoIBAQCT11o9yebJmjiq7mXbLtnr5THpTnyahNpKECI+N8YZSl5+cS9hGa06zK
QV3MNxbjJ15smmeWbgynYGwqhs5ZXGUjzd8S1/M1A08z1VFhEJiODQ00f3BOocpIn25RQ
zFz/BOLREW7sLkrhuz/WVBR3bzp6T1gu3nKcRSNuNxO1p9490gS1LhsZYQKfNvncuxBCP
0GTNbUOXd6xkQ+EX5cEKoODUYWzOMdMAMlEEFb4jUjxYbbJoygwTMHpG2yGAQ2IXpB2/w
rrawivxDHlMHGpML+Ie8o6YBR4PDiOJmlCg9uIsirf65R1zhfcCxmNQ7z/IggC0WNQjZw
ymeZT9cFDdAgMBAAGjUzBRMB0GA1UdDgQWBBQb5eJeYLEpErJetb1eid5BgsS3uTAfBgN
VHSMEGDAWgBQb5eJeYLEpErJetb1eid5BgsS3uTAPBgNVHRMBAf8EBTADAQH/MA0GCSqG
SIb3DQEBCwUAA4IBAQBURnrjVbHVwfV/u/xjzK8p4dTke0xb0oKt0J5YeH95sRa66m3tQ
JYf0jbMNQ8InfXK0IzGM/uUOJX3daeOMQxMbJvaUDZV64kuU6IgkEQuLwkOP5k0Rc9+Su
RMlvWOB2exiyQkd2iHJtURuEtvB39LIr4pPDsicBAYxsm5ybIWCmqNMPkVl8Qks3lAXeF
+xvH11tmciTJSYP0Ud2psbV3lduD76UT2bzDGkr690KqroNS57WbQrHxEhtMbdq0cPfzq
FlxyhckqNYrcw2v1igQDhplQ2eUc4ye0Mvimj1Me2mWjPvilhvS3vDGhrmcx9mlishlI/
RFy6yDI1gtkF7eS"
}

4.1. FCI.SecretStore

FCI.SecretStore instructs the uCDN how to dereference the value of any MI.SecretValue objects linked to the store from other FCI objects via an embedded MI.SecretValue object. For further details, see the MI.SecretStore section.¶

The following is an example of FCI.SecretStore:¶

{
  "capabilities": [
    {
      "capability-type": "FCI.SecretStore",
      "capability-value": {
        "secret-store-id": "store-1",
        "secret-store-type": "MI.SecretStoreTypeEmbedded",
        "secret-store-config": {
           "format": "cms"
        }
      }
    }
  ]
}

4.2. FCI.SecretCertificate

FCI.SecretCertificate is used to share an [X.509] certificate to be utilized for encrypting embedded secret messages via an embedded MI.SecretCertificate object. For further details, see the MI.SecretCertificate section.¶

The following is an example of FCI.SecretCertificate:¶

{
  "capabilities": [
    {
      "capability-type": "FCI.SecretCertificate",
      "capability-value": {
        "certificate-id": "store-1",
        "certificate-value": "MIIDZTCCAk2gAwIBAgIUFJokJzAxDgUGsBd8uhS
blpMwSLAwDQYJKoZIhvcNAQELBQAwQjELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB0dlb3Jn
aWExITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMzAxMjMyMDM2M
DNaFw0yMzAyMjIyMDM2MDNaMEIxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdHZW9yZ2lhMS
EwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEBAQU
AA4IBDwAwggEKAoIBAQCT11o9yebJmjiq7mXbLtnr5THpTnyahNpKECI+N8YZSl5+cS9h
Ga06zKQV3MNxbjJ15smmeWbgynYGwqhs5ZXGUjzd8S1/M1A08z1VFhEJiODQ00f3BOocp
In25RQzFz/BOLREW7sLkrhuz/WVBR3bzp6T1gu3nKcRSNuNxO1p9490gS1LhsZYQKfNvn
cuxBCP0GTNbUOXd6xkQ+EX5cEKoODUYWzOMdMAMlEEFb4jUjxYbbJoygwTMHpG2yGAQ2I
XpB2/wrrawivxDHlMHGpML+Ie8o6YBR4PDiOJmlCg9uIsirf65R1zhfcCxmNQ7z/IggC0
WNQjZwymeZT9cFDdAgMBAAGjUzBRMB0GA1UdDgQWBBQb5eJeYLEpErJetb1eid5BgsS3u
TAfBgNVHSMEGDAWgBQb5eJeYLEpErJetb1eid5BgsS3uTAPBgNVHRMBAf8EBTADAQH/MA
0GCSqGSIb3DQEBCwUAA4IBAQBURnrjVbHVwfV/u/xjzK8p4dTke0xb0oKt0J5YeH95sRa
66m3tQJYf0jbMNQ8InfXK0IzGM/uUOJX3daeOMQxMbJvaUDZV64kuU6IgkEQuLwkOP5k0
Rc9+SuRMlvWOB2exiyQkd2iHJtURuEtvB39LIr4pPDsicBAYxsm5ybIWCmqNMPkVl8Qks
3lAXeF+xvH11tmciTJSYP0Ud2psbV3lduD76UT2bzDGkr690KqroNS57WbQrHxEhtMbdq
0cPfzqFlxyhckqNYrcw2v1igQDhplQ2eUc4ye0Mvimj1Me2mWjPvilhvS3vDGhrmcx9ml
ishlI/RFy6yDI1gtkF7eS"
      }
    }
  ]
}

5.1. Workflow: uCDN -> dCDN Embedded

The uCDN advertises FCI.SecretStore with a store-type of MI.SecretStoreTypeEmbedded; other FCI objects may contain MI.SecretValue objects that reference the store-id. MI.SecretValue objects that do not presently contain a secret-value property.¶

1. The uCDN advertises FCI.SecretStore with a store-type of MI.SecretStoreTypeEmbedded; other FCI objects may contain MI.SecretValue objects that reference the store-id. MI.SecretValue objects that do not presently contain a secret-value property.¶
2. The dCDN pushes the MI configuration with an MI.SecretCertificate.¶
3. The uCDN updates the advertised FCI.SecretStore with a certificate-id property that references the dCDN MI.SecretCertificate; any MI.SecretValue objects in other FCI objects now contain a secret-value property with the CMS encrypted secret.¶

5.2. Workflow: dCDN -> uCDN Embedded

The uCDN advertises an FCI.SecretCertificate.¶

1. The uCDN advertises an FCI.SecretCertificate.¶
2. The dCDN pushes the MI configuration containing MI.SecretStore with a store-type of MI.SecretStoreTypeEmbedded and a certificate-id referencing the FCI.SecretCertificate advertised by the uCDN. Other MI objects may contain MI.SecretValue objects with a secret-value property containing the CMS encrypted secret.¶

5.3. Workflow: Embedded Cleartext (uCDN and dCDN)

An MI.SecretStoreTypeEmbedded has a defined format of "cleartext".¶

1. An MI.SecretStoreTypeEmbedded has a defined format of "cleartext".¶
2. Any MI.SecretValue objects that reference the cleartext store contain a secret-value property with the unencrypted secret.¶

5.4. Workflow: uCDN -> dCDN Vault

The uCDN advertises an FCI.SecretStore with an appropriate configuration for accessing an instance of a HashiCorp Vault accessible to the dCDN. Other FCI objects may contain MI.SecretValue objects that reference the FCI.SecretStore and a secret-path property specifying the secret to retrieve.¶

5.5. Workflow: dCDN -> uCDN Vault

The dCDN pushes the MI configuration, including an MI.SecretStore with appropriate configuration for accessing an instance of a HashiCorp Vault accessible to the uCDN. Other MI objects may contain MI.SecretValue objects that reference the MI.SecretStore and a secret-path property specifying the secret to retrieve.¶

7.1. CDNI Payload Types

TBD.¶