From sh162551@sac.sfbay.sun.com Tue Jul 8 23:48:51 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m696mo2b026012 for ; Tue, 8 Jul 2008 23:48:51 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m696mkq9014165; Wed, 9 Jul 2008 07:48:49 +0100 (BST) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q00C0789CID00@brm-avmta-1.central.sun.com>; Wed, 09 Jul 2008 00:48:48 -0600 (MDT) Received: from dm-sfbay-01.sfbay.sun.com ([129.145.155.118]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00KXD89CJ160@brm-avmta-1.central.sun.com>; Wed, 09 Jul 2008 00:48:48 -0600 (MDT) Received: from sac.sfbay.sun.com (new-sac.SFBay.Sun.COM [129.146.175.65]) by dm-sfbay-01.sfbay.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m696mjVx062602; Tue, 08 Jul 2008 23:48:45 -0700 (PDT) Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m696miTU026005; Tue, 08 Jul 2008 23:48:44 -0700 (PDT) Received: (from sh162551@localhost) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8/Submit) id m696miK0026001; Tue, 08 Jul 2008 23:48:44 -0700 (PDT) Date: Tue, 08 Jul 2008 23:48:44 -0700 (PDT) From: Shi-Ying Irene Huang Subject: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] To: lsarc-ext@sun.com Cc: brian.cameron@sun.com, darren.moffat@sun.com, jeff.cai@sun.com, wyllys.ingersoll@sun.com Message-id: <200807090648.m696miK0026001@sac.sfbay.sun.com> Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 Status: RO Content-Length: 9898 Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI This information is Copyright 2008 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: gnome-keyring 1.2. Name of Document Author/Supplier: Author: Jeff Cai 1.3 Date of This Document: 08 July, 2008 4. Technical Description 1. Introduction 1.1. Project/Component Working Name: GNOME Keyring 1.2. Name of Document Author/Supplier: Author: Jeff Cai Sponser: Irene Huang 1.3. Date of This Document: 07/09/2008 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: LSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Robert O'Dea 1.4.4. The name of your business unit: Software - OPG 1.5. Email Aliases: 1.5.1. Responsible Manager: harry.lu@sun.com 1.5.2. Responsible Engineer: jeff.cai@sun.com 1.5.3. Marketing Manager: 1.5.4. Interest List: brian.cameron@sun.com darren.moffat@sun.com wyllys.ingersoll@sun.com 2. Project Summary 2.1. Project Description: GNOME Keyring is a system to store passwords and other sensitive data in a standardized way across all GNOME applications. A keyring stores a collection of encrypted passwords and encrypted information about those passwords. A user can have multiple keyrings, each for a different use, but there is a default one, called 'login'. There is also a special 'session' keyring which is not stored on disk and goes away when you log out. When a user logs into GNOME, the keyrings are locked and a master keyring password has to be provided in order to unlock each of them. This fast-track increments the version of gnome-keyring in Solaris from 2.20.3 to 2.22.3. 4. Technical Description: 4.1. Details: Compared with the previous version 2.20, following features have been added: - Basic X.509 certificate and key store. - PKCS#11 module for accessing cerfificates and keys. - Now includes an SSH agent. - Automatically activate keyring daemon via DBus if it is not already running. - Add a simpler API fro accessing and storing passwords. Older APIs exist too. Refer to [1] 4.2 GNOME Keyring SSH Agent GNOME Keyring includes an SSH agent which integrates with the gnome-keyring and user login for its passwords. It can also use the main X.509 private key store. GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it starts up. The id_rsa and id_dsa files in ~/.ssh are automatically usable through the SSH agent without first 'loading' them. Other X.509 private keys marked with the 'ssh-authentication' purpose are also usable. Additional SSH keys can be manually loaded and managed via the ssh-add command. If you use another SSH agent(such as the ssh-agent included with OpenSSH), you may want to disable the SSH agent in GNOME Keyring to prevent ssh from using it instead of your prefered SSH agent. You can set /apps/gnome-keyring/daemon-components/ssh gconf key to false. This prevents the SSH component of gnome-keyring from starting up when the user logs in. The default GNOME start up script (/usr/dt/config/Xsession.jds) will be changed to NOT start up "under" ssh-agent like it does today and instead ensure the environment variables for the gnome-keyring version are set early enough. 4.3 GNOME Keyring Certificates and Encryption Keys The following paths are searched for encryption keys and certificate files. - ~/.ssh/id_?sa - ~/.gnome2/keystore/* Most standard file formats for keys and certificates are supported: Certificates * Standard DER encoded certificates. * Certificates contained in PKCS#7 files. * Certificates contained in PKCS#8 files. * PEM encodings of the above. Encryption Keys * PKCS#1 RSA keys. * PKCS#8 encrypted RSA and DSA keys. * DER encoded DSA keys. * PEM encodings of the above. * OpenSSL PEM encrypted keys. File Encryption and Password Algorithms PKCS#5 PBE * DES CBC MD2 * DES CBC MD5 * DES CBC SHA1 PKCS#5 PBE2 * DES CBC SHA1 * 3DES CBC SHA1 * RC2-128 CBC SHA1 PKCS#12 PBE * RC4-128 STREAM SHA1 * 3DES CBC SHA1 * RC2-128 CBC SHA1 * RC2-40 CBC SHA1 Supported crypto mechanisms include - DSA: sign/verify - RSA: encrypt/decrypt sign/verify 4.4 GNOME Keyring Cryptoki (PKCS#11) Support PKCS#11 is a standard that lets applications use encryption keys and certificates on devices like smart cards. gnome-keyring implements this standard and acts such a device, storing keys and certificates and making them available for applications to use. PKCS#11 deals directly with things like RSA/DSA signing operations, and certificate attributes. It's a bit low level. Usually one uses PKCS#11 through a cyrpto library like NSS. [5] PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform the actual crypto operations, nowhere in the keyring/pkcs11 code do they actually re-implement RSA or DSA key-generation or crypto functionality. 4.5. Interfaces: Exported Interfaces Interface Classification Comments --------------- -------------- ----------------------- SUNWgnome-libs Uncommitted Package name (unchanged) SUNWgnome-libs-devel Uncommitted Package name (unchanged) /usr/lib/libgnome-keyring.so Volatile Symbolic Link (unchanged) /usr/lib/libgnome-keyring.so.0 Volatile SONAME (changed) /us/share/gconf/schemas/ \ Volatile GCONF keys schemas that gnome-keyring.schemas defines the preferences for the tools (New) /usr/bin/gnome-keyring-daemon Volatile (unchanged) /usr/lib/gnome-keyring-ask Project Private (unchanged) /usr/lib/gnome-keyring/ \ Volatile (New) gnome-keyring-pkcs11.so /usr/lib/pkgconfig/ \ gnome-keyring-1.pc Volatile (unchanged) /usr/include/gnome-keyring-1/ \ gnome-keyring.h Volatile (unchanged) /usr/include/gnome-keyring-1/ \ gnome-keyring-memory.h Volatile (unchanged) /usr/include/gnome-keyring-1/ \ gnome-keyring-result.h Volatile (unchanged) ~/.gnome2/keyrings Project Private Location where keyrings are stored /usr/share/dbus-1/services/ \ Project org.gnome.keyring.service Private DBus service file (New) org.gnome.keyrings.Daemon Volatile DBus interface (session interface) org.gnome.keyrings.Daemon \ GetSocketPath Volatile DBus method, return socket path. Imported Interfaces Interface Classification Comments --------------- --------------- ----------------------- GTK+ Committed LSARC/2008/207 GLib Committed LSARC/2008/207 D-Bus Volatile LSARC/2006/368 libhal Volatile PSARC/2005/399 libgcrypt Volatile LSARC/2008/354 libtasn1 Volatile LSARC/2008/390 4.6. Packaging & Delivery: No new packages are delivered. The two existing packages: SUNWgnome-libs(base package) - base package for binaries SUNWgnome-libs-devel (development package) - develoment package for 4.7 Security Impact: Please refer to [7]. 4.8 Dependencies: libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to parse X509 certificate and general certificate. 5. References [1] New API storing passwords: http://live.gnome.org/GnomeKeyring/StoringPasswords [2] Homepage: http://live.gnome.org/GnomeKeyring [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/ [4] GNOME 2.14 ARC: LSARC/2006/202/ [5] Configure other applications to use gnome-keyring certificates and keys: http://live.gnome.org/GnomeKeyring/ApplicationSetup [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki [7] GNOME 2.14 security questionnaire: http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: Desktop 6.5. ARC review type: FastTrack 6.6. ARC Exposure: open From John.Fischer@sun.com Wed Jul 9 08:53:19 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m69FrIHM010029 for ; Wed, 9 Jul 2008 08:53:19 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m69FrBlZ012475 for <@sunmail2sca.sfbay.sun.com:lsarc-ext@sun.com>; Wed, 9 Jul 2008 23:53:17 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q00713XGREZ00@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 09 Jul 2008 08:53:15 -0700 (PDT) Received: from brmea-mail-4.sun.com ([192.18.98.36]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00L66XGQGI60@nwk-avmta-1.sfbay.Sun.COM> for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 09 Jul 2008 08:53:14 -0700 (PDT) Received: from fe-amer-09.sun.com ([192.18.109.79]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m69FrEYt004016 for ; Wed, 09 Jul 2008 15:53:14 +0000 (GMT) Received: from conversion-daemon.mail-amer.sun.com by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K3Q00G01W5E3S00@mail-amer.sun.com> (original mail from John.Fischer@Sun.COM) for lsarc-ext@sun.com (ORCPT lsarc-ext@sun.com); Wed, 09 Jul 2008 09:53:14 -0600 (MDT) Received: from 129.145.154.111 ([129.145.154.111]) by mail-amer.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K3Q00HYUXGMGJ60@mail-amer.sun.com>; Wed, 09 Jul 2008 09:53:11 -0600 (MDT) Date: Wed, 09 Jul 2008 08:53:10 -0700 From: John Fischer Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <200807090648.m696miK0026001@sac.sfbay.sun.com> Sender: John.Fischer@sun.com To: Shi-Ying Irene Huang , Jeff.Cai@sun.com Cc: John Fischer , LSARC-ext@sun.com, Brian Cameron , Darren J Moffat , Jeff.Cai@sun.com, Wyllys.Ingersoll@sun.com Reply-to: John.Fischer@sun.com Message-id: <1215618789.5256.871.camel@sr1-umpk-11> MIME-version: 1.0 X-Mailer: Ximian Evolution 1.4.6.301 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> Status: RO Content-Length: 11121 Jeff, Just a few questions... How does this work with Trusted Extensions? Will there be a separate keyring per label? Has this been answered previously in another ARC case? > /usr/lib/gnome-keyring/ \ Volatile (New) > gnome-keyring-pkcs11.so This appears to be a Project Private library as it is hidden underneath /usr/lib/gnome-keyring directory. Is that correct? If so then it should be declared as Project Private. It appears from the document that the default behavior is to have the ssh agent turned off for Solaris. Thus it will use OpenSSH. Is that correct? Thanks, John On Tue, 2008-07-08 at 23:48, Shi-Ying Irene Huang wrote: > Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI > This information is Copyright 2008 Sun Microsystems > 1. Introduction > 1.1. Project/Component Working Name: > gnome-keyring > 1.2. Name of Document Author/Supplier: > Author: Jeff Cai > 1.3 Date of This Document: > 08 July, 2008 > 4. Technical Description > 1. Introduction > 1.1. Project/Component Working Name: > > GNOME Keyring > > 1.2. Name of Document Author/Supplier: > > Author: Jeff Cai > Sponser: Irene Huang > > 1.3. Date of This Document: > > 07/09/2008 > > 1.4. Name of Major Document Customer(s)/Consumer(s): > > 1.4.1. The PAC or CPT you expect to review your project: > > Solaris PAC > > 1.4.2. The ARC(s) you expect to review your project: > > LSARC > > 1.4.3. The Director/VP who is "Sponsoring" this project: > > Robert O'Dea > > 1.4.4. The name of your business unit: > > Software - OPG > > 1.5. Email Aliases: > 1.5.1. Responsible Manager: harry.lu@sun.com > 1.5.2. Responsible Engineer: jeff.cai@sun.com > 1.5.3. Marketing Manager: > 1.5.4. Interest List: brian.cameron@sun.com > darren.moffat@sun.com > wyllys.ingersoll@sun.com > > 2. Project Summary > 2.1. Project Description: > > GNOME Keyring is a system to store passwords and other sensitive data in a > standardized way across all GNOME applications. > > A keyring stores a collection of encrypted passwords and encrypted > information about those passwords. A user can have multiple keyrings, each > for a different use, but there is a default one, called 'login'. There is > also a special 'session' keyring which is not stored on disk and goes away > when you log out. > > When a user logs into GNOME, the keyrings are locked and a master keyring > password has to be provided in order to unlock each of them. > > This fast-track increments the version of gnome-keyring in Solaris > from 2.20.3 to 2.22.3. > > 4. Technical Description: > > 4.1. Details: > > Compared with the previous version 2.20, following features have been added: > > - Basic X.509 certificate and key store. > - PKCS#11 module for accessing cerfificates and keys. > - Now includes an SSH agent. > - Automatically activate keyring daemon via DBus if it is not already > running. > - Add a simpler API fro accessing and storing passwords. Older APIs > exist too. Refer to [1] > > 4.2 GNOME Keyring SSH Agent > > GNOME Keyring includes an SSH agent which integrates with the gnome-keyring > and user login for its passwords. It can also use the main X.509 private > key store. > > GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it > starts up. > > The id_rsa and id_dsa files in ~/.ssh are automatically usable through the > SSH agent without first 'loading' them. Other X.509 private keys marked > with the 'ssh-authentication' purpose are also usable. > > Additional SSH keys can be manually loaded and managed via the ssh-add > command. > > If you use another SSH agent(such as the ssh-agent included with OpenSSH), > you may want to disable the SSH agent in GNOME Keyring to prevent ssh from > using it instead of your prefered SSH agent. You can set > /apps/gnome-keyring/daemon-components/ssh > gconf key to false. This prevents the SSH component of gnome-keyring from > starting up when the user logs in. > > The default GNOME start up script (/usr/dt/config/Xsession.jds) will be > changed to NOT start up "under" ssh-agent like it does today and instead > ensure the environment variables for the gnome-keyring version are set > early enough. > > 4.3 GNOME Keyring Certificates and Encryption Keys > > The following paths are searched for encryption keys and certificate files. > > - ~/.ssh/id_?sa > - ~/.gnome2/keystore/* > > Most standard file formats for keys and certificates are supported: > > Certificates > > * Standard DER encoded certificates. > * Certificates contained in PKCS#7 files. > * Certificates contained in PKCS#8 files. > * PEM encodings of the above. > > Encryption Keys > > * PKCS#1 RSA keys. > * PKCS#8 encrypted RSA and DSA keys. > * DER encoded DSA keys. > * PEM encodings of the above. > * OpenSSL PEM encrypted keys. > > File Encryption and Password Algorithms > > PKCS#5 PBE > > * DES CBC MD2 > * DES CBC MD5 > * DES CBC SHA1 > > PKCS#5 PBE2 > > * DES CBC SHA1 > * 3DES CBC SHA1 > * RC2-128 CBC SHA1 > > PKCS#12 PBE > > * RC4-128 STREAM SHA1 > * 3DES CBC SHA1 > * RC2-128 CBC SHA1 > * RC2-40 CBC SHA1 > > Supported crypto mechanisms include > > - DSA: sign/verify > - RSA: encrypt/decrypt sign/verify > > 4.4 GNOME Keyring Cryptoki (PKCS#11) Support > > PKCS#11 is a standard that lets applications use encryption keys and > certificates on devices like smart cards. gnome-keyring implements this > standard and acts such a device, storing keys and certificates and > making them available for applications to use. > > PKCS#11 deals directly with things like RSA/DSA signing operations, and > certificate attributes. It's a bit low level. Usually one uses PKCS#11 > through a cyrpto library like NSS. [5] > > PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform > the actual crypto operations, nowhere in the keyring/pkcs11 code do they > actually re-implement RSA or DSA key-generation or crypto functionality. > > > 4.5. Interfaces: > Exported Interfaces > Interface Classification Comments > --------------- -------------- ----------------------- > SUNWgnome-libs Uncommitted Package name (unchanged) > SUNWgnome-libs-devel Uncommitted Package name (unchanged) > > /usr/lib/libgnome-keyring.so Volatile Symbolic Link (unchanged) > /usr/lib/libgnome-keyring.so.0 Volatile SONAME (changed) > > > /us/share/gconf/schemas/ \ Volatile GCONF keys schemas that > gnome-keyring.schemas defines the preferences for > the tools (New) > > /usr/bin/gnome-keyring-daemon Volatile (unchanged) > /usr/lib/gnome-keyring-ask Project Private (unchanged) > > /usr/lib/gnome-keyring/ \ Volatile (New) > gnome-keyring-pkcs11.so > > /usr/lib/pkgconfig/ \ > gnome-keyring-1.pc Volatile (unchanged) > /usr/include/gnome-keyring-1/ \ > gnome-keyring.h Volatile (unchanged) > /usr/include/gnome-keyring-1/ \ > gnome-keyring-memory.h Volatile (unchanged) > /usr/include/gnome-keyring-1/ \ > gnome-keyring-result.h Volatile (unchanged) > > ~/.gnome2/keyrings Project Private Location where keyrings > are stored > > /usr/share/dbus-1/services/ \ Project > org.gnome.keyring.service Private DBus service file (New) > > org.gnome.keyrings.Daemon Volatile DBus interface > (session interface) > org.gnome.keyrings.Daemon \ > GetSocketPath Volatile DBus method, return > socket path. > Imported Interfaces > Interface Classification Comments > --------------- --------------- ----------------------- > GTK+ Committed LSARC/2008/207 > GLib Committed LSARC/2008/207 > D-Bus Volatile LSARC/2006/368 > libhal Volatile PSARC/2005/399 > libgcrypt Volatile LSARC/2008/354 > libtasn1 Volatile LSARC/2008/390 > > 4.6. Packaging & Delivery: > > No new packages are delivered. The two existing packages: > SUNWgnome-libs(base package) - base package for binaries > SUNWgnome-libs-devel (development package) - develoment package for > > 4.7 Security Impact: > > Please refer to [7]. > > 4.8 Dependencies: > > libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to > parse X509 certificate and general certificate. > > 5. References > [1] New API storing passwords: > http://live.gnome.org/GnomeKeyring/StoringPasswords > [2] Homepage: > http://live.gnome.org/GnomeKeyring > [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/ > [4] GNOME 2.14 ARC: LSARC/2006/202/ > [5] Configure other applications to use gnome-keyring certificates and keys: > http://live.gnome.org/GnomeKeyring/ApplicationSetup > [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki > [7] GNOME 2.14 security questionnaire: > http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt > > > 6. Resources and Schedule > 6.4. Steering Committee requested information > 6.4.1. Consolidation C-team Name: > Desktop > 6.5. ARC review type: FastTrack > 6.6. ARC Exposure: open > From Nicolas.Williams@sun.com Wed Jul 9 08:59:00 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m69FwxC0010540 for ; Wed, 9 Jul 2008 08:58:59 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m69Fwnof014521; Wed, 9 Jul 2008 23:58:55 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q0070HXQ6HZ00@brm-avmta-1.central.sun.com>; Wed, 09 Jul 2008 09:58:54 -0600 (MDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00098XQ5GT80@brm-avmta-1.central.sun.com>; Wed, 09 Jul 2008 09:58:53 -0600 (MDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m69Fwq4r015418; Wed, 09 Jul 2008 10:58:52 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m69FwpJk015417; Wed, 09 Jul 2008 10:58:51 -0500 (CDT) Date: Wed, 09 Jul 2008 10:58:51 -0500 From: Nicolas Williams Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <1215618789.5256.871.camel@sr1-umpk-11> To: John Fischer Cc: Shi-Ying Irene Huang , Jeff.Cai@sun.com, Wyllys.Ingersoll@sun.com, LSARC-ext@sun.com Message-id: <20080709155851.GE2735@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 488 On Wed, Jul 09, 2008 at 08:53:10AM -0700, John Fischer wrote: > It appears from the document that the default behavior > is to have the ssh agent turned off for Solaris. Thus > it will use OpenSSH. Is that correct? The SunSSH ssh-agent is on by default today. As I read the case the SunSSH agent will remain but the agent implementation from gnome-keyring will be used instead. Only users who have been using an alternate implementation of the agent (e.g., OpenSSH) have work to do. From Nicolas.Williams@sun.com Wed Jul 9 09:02:48 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m69G2llG010860 for ; Wed, 9 Jul 2008 09:02:47 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m69G2dKv016644; Thu, 10 Jul 2008 00:02:42 +0800 (SGT) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q0081LXWFYI00@nwk-avmta-1.sfbay.Sun.COM>; Wed, 09 Jul 2008 09:02:39 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00LWEXWEGL60@nwk-avmta-1.sfbay.Sun.COM>; Wed, 09 Jul 2008 09:02:38 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m69G2b0d015426; Wed, 09 Jul 2008 11:02:37 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m69G2bPZ015425; Wed, 09 Jul 2008 11:02:37 -0500 (CDT) Date: Wed, 09 Jul 2008 11:02:36 -0500 From: Nicolas Williams Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <1215618789.5256.871.camel@sr1-umpk-11> To: John Fischer Cc: Shi-Ying Irene Huang , Jeff.Cai@sun.com, Wyllys.Ingersoll@sun.com, LSARC-ext@sun.com Message-id: <20080709160236.GF2735@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 650 On Wed, Jul 09, 2008 at 08:53:10AM -0700, John Fischer wrote: > Just a few questions... > > How does this work with Trusted Extensions? Will there > be a separate keyring per label? Has this been answered > previously in another ARC case? > > > /usr/lib/gnome-keyring/ \ Volatile (New) > > gnome-keyring-pkcs11.so > > This appears to be a Project Private library as it is > hidden underneath /usr/lib/gnome-keyring directory. > Is that correct? If so then it should be declared as > Project Private. A more interesting question is how this module fits into the Solaris cryptographic framework. From Darren.Moffat@sun.com Wed Jul 9 09:08:27 2008 Received: from sunmail5.uk.sun.com (sunmail5.UK.Sun.COM [129.156.85.165]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m69G8RUF010986 for ; Wed, 9 Jul 2008 09:08:27 -0700 (PDT) Received: from nwk-avmta-1.SFBay.Sun.COM (nwk-avmta-1.SFBay.Sun.COM [129.146.11.74]) by sunmail5.uk.sun.com (8.13.8+Sun/8.13.8/ENSMAIL,v2.2) with ESMTP id m69G8Jj1027385 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Wed, 9 Jul 2008 17:08:26 +0100 (BST) Received: from pmxchannel-daemon.nwk-avmta-1.sfbay.Sun.COM by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q00901Y61GI00@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 09 Jul 2008 09:08:25 -0700 (PDT) Received: from gmp-eb-inf-1.sun.com ([192.18.6.21]) by nwk-avmta-1.sfbay.Sun.COM (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00LM6Y60GE70@nwk-avmta-1.sfbay.Sun.COM> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 09 Jul 2008 09:08:25 -0700 (PDT) Received: from fe-emea-09.sun.com (gmp-eb-lb-2-fe1.eu.sun.com [192.18.6.10]) by gmp-eb-inf-1.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m69G8OZg008938 for ; Wed, 09 Jul 2008 16:08:24 +0000 (GMT) Received: from conversion-daemon.fe-emea-09.sun.com by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K3Q00201X83PA00@fe-emea-09.sun.com> (original mail from Darren.Moffat@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Wed, 09 Jul 2008 17:08:24 +0100 (BST) Received: from [129.156.173.21] by fe-emea-09.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K3Q00JQXY5KHX50@fe-emea-09.sun.com>; Wed, 09 Jul 2008 17:08:13 +0100 (BST) Date: Wed, 09 Jul 2008 17:08:08 +0100 From: Darren J Moffat Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <20080709160236.GF2735@Sun.COM> Sender: Darren.Moffat@sun.com To: Nicolas Williams Cc: John Fischer , Shi-Ying Irene Huang , Jeff.Cai@sun.com, Wyllys.Ingersoll@sun.com, LSARC-ext@sun.com Message-id: <4874E268.5080904@Sun.COM> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=ISO-8859-1 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> <20080709160236.GF2735@Sun.COM> User-Agent: Thunderbird 2.0.0.14 (X11/20080602) Status: RO Content-Length: 1241 Nicolas Williams wrote: > On Wed, Jul 09, 2008 at 08:53:10AM -0700, John Fischer wrote: >> Just a few questions... >> >> How does this work with Trusted Extensions? Will there >> be a separate keyring per label? Has this been answered >> previously in another ARC case? >> >>> /usr/lib/gnome-keyring/ \ Volatile (New) >>> gnome-keyring-pkcs11.so >> This appears to be a Project Private library as it is >> hidden underneath /usr/lib/gnome-keyring directory. >> Is that correct? If so then it should be declared as >> Project Private. > > A more interesting question is how this module fits into the Solaris > cryptographic framework. It can be added as a provider using cryptoadm(1M). The project team consulted myself and Wyllys Ingersoll before submitting this case and we recommended to ship the module but at this stage it isn't hooked into the crypto framework by default. # cryptoadm install \ provider=/usr/lib/gnome-keyring/gnome-keyring-pkcs11.so The plan is that we will ship the module elfsigned appropriately so that this can be done if desired. A future case may have it in the default configuration once we have more experience with it. -- Darren J Moffat From Nicolas.Williams@sun.com Wed Jul 9 09:30:40 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m69GUegB011885 for ; Wed, 9 Jul 2008 09:30:40 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m69GUZ3C018404; Wed, 9 Jul 2008 09:30:36 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3Q0050TZ6Z5400@nwk-avmta-2.sfbay.sun.com>; Wed, 09 Jul 2008 09:30:35 -0700 (PDT) Received: from binky.Central.Sun.COM ([129.153.128.104]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3Q00L18Z6Y6LC0@nwk-avmta-2.sfbay.sun.com>; Wed, 09 Jul 2008 09:30:34 -0700 (PDT) Received: from binky.Central.Sun.COM (localhost [127.0.0.1]) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1) with ESMTP id m69GUXm3015437; Wed, 09 Jul 2008 11:30:33 -0500 (CDT) Received: (from nw141292@localhost) by binky.Central.Sun.COM (8.14.1+Sun/8.14.1/Submit) id m69GUXOj015436; Wed, 09 Jul 2008 11:30:33 -0500 (CDT) Date: Wed, 09 Jul 2008 11:30:33 -0500 From: Nicolas Williams Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <4874E268.5080904@Sun.COM> To: Darren J Moffat Cc: John Fischer , Shi-Ying Irene Huang , Jeff.Cai@sun.com, Wyllys.Ingersoll@sun.com, LSARC-ext@sun.com Message-id: <20080709163032.GG2735@Sun.COM> MIME-version: 1.0 Content-type: text/plain; charset=us-ascii Content-transfer-encoding: 7BIT Content-disposition: inline X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> <20080709160236.GF2735@Sun.COM> <4874E268.5080904@Sun.COM> X-Authentication-warning: binky.Central.Sun.COM: nw141292 set sender to Nicolas.Williams@sun.com using -f User-Agent: Mutt/1.5.7i Status: RO Content-Length: 1397 On Wed, Jul 09, 2008 at 05:08:08PM +0100, Darren J Moffat wrote: > Nicolas Williams wrote: > >On Wed, Jul 09, 2008 at 08:53:10AM -0700, John Fischer wrote: > >>Just a few questions... > >> > >>How does this work with Trusted Extensions? Will there > >>be a separate keyring per label? Has this been answered > >>previously in another ARC case? > >> > >>> /usr/lib/gnome-keyring/ \ Volatile (New) > >>> gnome-keyring-pkcs11.so > >>This appears to be a Project Private library as it is > >>hidden underneath /usr/lib/gnome-keyring directory. > >>Is that correct? If so then it should be declared as > >>Project Private. > > > >A more interesting question is how this module fits into the Solaris > >cryptographic framework. > > It can be added as a provider using cryptoadm(1M). The project team > consulted myself and Wyllys Ingersoll before submitting this case and we > recommended to ship the module but at this stage it isn't hooked into > the crypto framework by default. > > # cryptoadm install \ > provider=/usr/lib/gnome-keyring/gnome-keyring-pkcs11.so > > The plan is that we will ship the module elfsigned appropriately so that > this can be done if desired. > > A future case may have it in the default configuration once we have more > experience with it. Right, so the stability of this path (and 64-bit) is relevant. From Jeff.Cai@sun.com Wed Jul 9 23:02:24 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6A62NHF010976 for ; Wed, 9 Jul 2008 23:02:24 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6A62LXb005367 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Thu, 10 Jul 2008 14:02:23 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K3S0040V0RXRZ00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 10 Jul 2008 00:02:21 -0600 (MDT) Received: from sineb-mail-1.sun.com ([192.18.19.6]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K3S0018J0RVFS40@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 10 Jul 2008 00:02:20 -0600 (MDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6A62kfw006125 for ; Thu, 10 Jul 2008 06:02:46 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0K3S00F010LVUZ00@mail-apac.sun.com> (original mail from Jeff.Cai@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Thu, 10 Jul 2008 14:01:50 +0800 (SGT) Received: from [129.158.217.199] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0K3S004OR0QYPGDN@mail-apac.sun.com>; Thu, 10 Jul 2008 14:01:48 +0800 (SGT) Date: Thu, 10 Jul 2008 13:59:23 +0800 From: Jeff Cai Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <1215618789.5256.871.camel@sr1-umpk-11> Sender: Jeff.Cai@sun.com To: John.Fischer@sun.com Cc: Shi-Ying Irene Huang , LSARC-ext@sun.com, Brian Cameron , Darren J Moffat , Wyllys.Ingersoll@sun.com, Stephen.Browne@sun.com Message-id: <4875A53B.4060300@sun.com> MIME-version: 1.0 Content-type: text/plain; format=flowed; charset=UTF-8 Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> User-Agent: Thunderbird 2.0.0.14 (X11/20080701) Status: RO Content-Length: 11880 John Fischer wrote: > Jeff, > > Just a few questions... > > How does this work with Trusted Extensions? Will there > be a separate keyring per label? Has this been answered > previously in another ARC case? > This issue has not been discussed before. I think Stephen Browne can give more about it. > >> /usr/lib/gnome-keyring/ \ Volatile (New) >> gnome-keyring-pkcs11.so >> > > This appears to be a Project Private library as it is > hidden underneath /usr/lib/gnome-keyring directory. > Is that correct? If so then it should be declared as > Project Private. > As Darren has said, the library can be added by cryptoadm(1M) as a provider, so I'd like it to be a volatile interface. > It appears from the document that the default behavior > is to have the ssh agent turned off for Solaris. Thus > it will use OpenSSH. Is that correct? > Currently, ssh-agent is started in /usr/dt/config/Xsession.jds. Since gnome-session will also start gnome-keyring-daemon with ssh agent enabled, the start script of ssh-agent in Xsession.jds will be removed in case of the confliction. Jeff > Thanks, > > John > > On Tue, 2008-07-08 at 23:48, Shi-Ying Irene Huang wrote: > >> Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI >> This information is Copyright 2008 Sun Microsystems >> 1. Introduction >> 1.1. Project/Component Working Name: >> gnome-keyring >> 1.2. Name of Document Author/Supplier: >> Author: Jeff Cai >> 1.3 Date of This Document: >> 08 July, 2008 >> 4. Technical Description >> 1. Introduction >> 1.1. Project/Component Working Name: >> >> GNOME Keyring >> >> 1.2. Name of Document Author/Supplier: >> >> Author: Jeff Cai >> Sponser: Irene Huang >> >> 1.3. Date of This Document: >> >> 07/09/2008 >> >> 1.4. Name of Major Document Customer(s)/Consumer(s): >> >> 1.4.1. The PAC or CPT you expect to review your project: >> >> Solaris PAC >> >> 1.4.2. The ARC(s) you expect to review your project: >> >> LSARC >> >> 1.4.3. The Director/VP who is "Sponsoring" this project: >> >> Robert O'Dea >> >> 1.4.4. The name of your business unit: >> >> Software - OPG >> >> 1.5. Email Aliases: >> 1.5.1. Responsible Manager: harry.lu@sun.com >> 1.5.2. Responsible Engineer: jeff.cai@sun.com >> 1.5.3. Marketing Manager: >> 1.5.4. Interest List: brian.cameron@sun.com >> darren.moffat@sun.com >> wyllys.ingersoll@sun.com >> >> 2. Project Summary >> 2.1. Project Description: >> >> GNOME Keyring is a system to store passwords and other sensitive data in a >> standardized way across all GNOME applications. >> >> A keyring stores a collection of encrypted passwords and encrypted >> information about those passwords. A user can have multiple keyrings, each >> for a different use, but there is a default one, called 'login'. There is >> also a special 'session' keyring which is not stored on disk and goes away >> when you log out. >> >> When a user logs into GNOME, the keyrings are locked and a master keyring >> password has to be provided in order to unlock each of them. >> >> This fast-track increments the version of gnome-keyring in Solaris >> from 2.20.3 to 2.22.3. >> >> 4. Technical Description: >> >> 4.1. Details: >> >> Compared with the previous version 2.20, following features have been added: >> >> - Basic X.509 certificate and key store. >> - PKCS#11 module for accessing cerfificates and keys. >> - Now includes an SSH agent. >> - Automatically activate keyring daemon via DBus if it is not already >> running. >> - Add a simpler API fro accessing and storing passwords. Older APIs >> exist too. Refer to [1] >> >> 4.2 GNOME Keyring SSH Agent >> >> GNOME Keyring includes an SSH agent which integrates with the gnome-keyring >> and user login for its passwords. It can also use the main X.509 private >> key store. >> >> GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it >> starts up. >> >> The id_rsa and id_dsa files in ~/.ssh are automatically usable through the >> SSH agent without first 'loading' them. Other X.509 private keys marked >> with the 'ssh-authentication' purpose are also usable. >> >> Additional SSH keys can be manually loaded and managed via the ssh-add >> command. >> >> If you use another SSH agent(such as the ssh-agent included with OpenSSH), >> you may want to disable the SSH agent in GNOME Keyring to prevent ssh from >> using it instead of your prefered SSH agent. You can set >> /apps/gnome-keyring/daemon-components/ssh >> gconf key to false. This prevents the SSH component of gnome-keyring from >> starting up when the user logs in. >> >> The default GNOME start up script (/usr/dt/config/Xsession.jds) will be >> changed to NOT start up "under" ssh-agent like it does today and instead >> ensure the environment variables for the gnome-keyring version are set >> early enough. >> >> 4.3 GNOME Keyring Certificates and Encryption Keys >> >> The following paths are searched for encryption keys and certificate files. >> >> - ~/.ssh/id_?sa >> - ~/.gnome2/keystore/* >> >> Most standard file formats for keys and certificates are supported: >> >> Certificates >> >> * Standard DER encoded certificates. >> * Certificates contained in PKCS#7 files. >> * Certificates contained in PKCS#8 files. >> * PEM encodings of the above. >> >> Encryption Keys >> >> * PKCS#1 RSA keys. >> * PKCS#8 encrypted RSA and DSA keys. >> * DER encoded DSA keys. >> * PEM encodings of the above. >> * OpenSSL PEM encrypted keys. >> >> File Encryption and Password Algorithms >> >> PKCS#5 PBE >> >> * DES CBC MD2 >> * DES CBC MD5 >> * DES CBC SHA1 >> >> PKCS#5 PBE2 >> >> * DES CBC SHA1 >> * 3DES CBC SHA1 >> * RC2-128 CBC SHA1 >> >> PKCS#12 PBE >> >> * RC4-128 STREAM SHA1 >> * 3DES CBC SHA1 >> * RC2-128 CBC SHA1 >> * RC2-40 CBC SHA1 >> >> Supported crypto mechanisms include >> >> - DSA: sign/verify >> - RSA: encrypt/decrypt sign/verify >> >> 4.4 GNOME Keyring Cryptoki (PKCS#11) Support >> >> PKCS#11 is a standard that lets applications use encryption keys and >> certificates on devices like smart cards. gnome-keyring implements this >> standard and acts such a device, storing keys and certificates and >> making them available for applications to use. >> >> PKCS#11 deals directly with things like RSA/DSA signing operations, and >> certificate attributes. It's a bit low level. Usually one uses PKCS#11 >> through a cyrpto library like NSS. [5] >> >> PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform >> the actual crypto operations, nowhere in the keyring/pkcs11 code do they >> actually re-implement RSA or DSA key-generation or crypto functionality. >> >> >> 4.5. Interfaces: >> Exported Interfaces >> Interface Classification Comments >> --------------- -------------- ----------------------- >> SUNWgnome-libs Uncommitted Package name (unchanged) >> SUNWgnome-libs-devel Uncommitted Package name (unchanged) >> >> /usr/lib/libgnome-keyring.so Volatile Symbolic Link (unchanged) >> /usr/lib/libgnome-keyring.so.0 Volatile SONAME (changed) >> >> >> /us/share/gconf/schemas/ \ Volatile GCONF keys schemas that >> gnome-keyring.schemas defines the preferences for >> the tools (New) >> >> /usr/bin/gnome-keyring-daemon Volatile (unchanged) >> /usr/lib/gnome-keyring-ask Project Private (unchanged) >> >> /usr/lib/gnome-keyring/ \ Volatile (New) >> gnome-keyring-pkcs11.so >> >> /usr/lib/pkgconfig/ \ >> gnome-keyring-1.pc Volatile (unchanged) >> /usr/include/gnome-keyring-1/ \ >> gnome-keyring.h Volatile (unchanged) >> /usr/include/gnome-keyring-1/ \ >> gnome-keyring-memory.h Volatile (unchanged) >> /usr/include/gnome-keyring-1/ \ >> gnome-keyring-result.h Volatile (unchanged) >> >> ~/.gnome2/keyrings Project Private Location where keyrings >> are stored >> >> /usr/share/dbus-1/services/ \ Project >> org.gnome.keyring.service Private DBus service file (New) >> >> org.gnome.keyrings.Daemon Volatile DBus interface >> (session interface) >> org.gnome.keyrings.Daemon \ >> GetSocketPath Volatile DBus method, return >> socket path. >> Imported Interfaces >> Interface Classification Comments >> --------------- --------------- ----------------------- >> GTK+ Committed LSARC/2008/207 >> GLib Committed LSARC/2008/207 >> D-Bus Volatile LSARC/2006/368 >> libhal Volatile PSARC/2005/399 >> libgcrypt Volatile LSARC/2008/354 >> libtasn1 Volatile LSARC/2008/390 >> >> 4.6. Packaging & Delivery: >> >> No new packages are delivered. The two existing packages: >> SUNWgnome-libs(base package) - base package for binaries >> SUNWgnome-libs-devel (development package) - develoment package for >> >> 4.7 Security Impact: >> >> Please refer to [7]. >> >> 4.8 Dependencies: >> >> libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to >> parse X509 certificate and general certificate. >> >> 5. References >> [1] New API storing passwords: >> http://live.gnome.org/GnomeKeyring/StoringPasswords >> [2] Homepage: >> http://live.gnome.org/GnomeKeyring >> [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/ >> [4] GNOME 2.14 ARC: LSARC/2006/202/ >> [5] Configure other applications to use gnome-keyring certificates and keys: >> http://live.gnome.org/GnomeKeyring/ApplicationSetup >> [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki >> [7] GNOME 2.14 security questionnaire: >> http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt >> >> >> 6. Resources and Schedule >> 6.4. Steering Committee requested information >> 6.4.1. Consolidation C-team Name: >> Desktop >> 6.5. ARC review type: FastTrack >> 6.6. ARC Exposure: open >> >> > > From Stephen.Browne@sun.com Mon Jul 14 07:07:41 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6EE7fWq002916 for ; Mon, 14 Jul 2008 07:07:41 -0700 (PDT) Received: from nwk-avmta-2.sfbay.sun.com (nwk-avmta-2.SFBay.Sun.COM [129.145.155.6]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m6EE7dAA000287 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Mon, 14 Jul 2008 07:07:41 -0700 (PDT) Received: from pmxchannel-daemon.nwk-avmta-2.sfbay.sun.com by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K4000M011WS7Y00@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 14 Jul 2008 07:07:40 -0700 (PDT) Received: from gmp-eb-inf-2.sun.com ([192.18.6.24]) by nwk-avmta-2.sfbay.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K4000G761WQ4F60@nwk-avmta-2.sfbay.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 14 Jul 2008 07:07:39 -0700 (PDT) Received: from fe-emea-10.sun.com (gmp-eb-lb-2-fe2.eu.sun.com [192.18.6.11]) by gmp-eb-inf-2.sun.com (8.13.7+Sun/8.12.9) with ESMTP id m6EE7cgl017066 for ; Mon, 14 Jul 2008 14:07:38 +0000 (GMT) Received: from conversion-daemon.fe-emea-10.sun.com by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) id <0K40008011KX6N00@fe-emea-10.sun.com> (original mail from Stephen.Browne@Sun.COM) for LSARC-ext@sun.com (ORCPT LSARC-ext@sun.com); Mon, 14 Jul 2008 15:07:38 +0100 (BST) Received: from 129.156.220.16 ([129.156.220.16]) by fe-emea-10.sun.com (Sun Java System Messaging Server 6.2-8.04 (built Feb 28 2007)) with ESMTPSA id <0K40006Y81WG4AD0@fe-emea-10.sun.com>; Mon, 14 Jul 2008 15:07:28 +0100 (BST) Date: Mon, 14 Jul 2008 15:07:28 +0100 From: Stephen Browne Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <4875A53B.4060300@sun.com> Sender: Stephen.Browne@sun.com To: Jeff Cai Cc: John.Fischer@sun.com, Shi-Ying Irene Huang , LSARC-ext@sun.com, Brian Cameron , Darren J Moffat , Wyllys.Ingersoll@sun.com Message-id: <1216044446.56692.4.camel@sr1-edub-02> MIME-version: 1.0 X-Mailer: Ximian Evolution 1.4.6.301 Content-type: multipart/alternative; boundary="Boundary_(ID_bjgGJ9nycXRYOD8mk7t8vQ)" X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> <4875A53B.4060300@sun.com> Status: RO Content-Length: 27368 --Boundary_(ID_bjgGJ9nycXRYOD8mk7t8vQ) Content-type: text/plain Content-transfer-encoding: 7BIT John, gnome-keyring is started at each label the user instantiates a workspace for. Stephen. On Thu, 2008-07-10 at 06:59, Jeff Cai wrote: > John Fischer wrote: > > Jeff, > > > > Just a few questions... > > > > How does this work with Trusted Extensions? Will there > > be a separate keyring per label? Has this been answered > > previously in another ARC case? > > > This issue has not been discussed before. I think Stephen Browne can > give more about it. > > > >> /usr/lib/gnome-keyring/ \ Volatile (New) > >> gnome-keyring-pkcs11.so > >> > > > > This appears to be a Project Private library as it is > > hidden underneath /usr/lib/gnome-keyring directory. > > Is that correct? If so then it should be declared as > > Project Private. > > > As Darren has said, the library can be added by cryptoadm(1M) as a > provider, so I'd like it to be a volatile interface. > > It appears from the document that the default behavior > > is to have the ssh agent turned off for Solaris. Thus > > it will use OpenSSH. Is that correct? > > > Currently, ssh-agent is started in /usr/dt/config/Xsession.jds. Since > gnome-session will also start gnome-keyring-daemon with ssh agent > enabled, the start script of ssh-agent in Xsession.jds will be removed > in case of the confliction. > > Jeff > > Thanks, > > > > John > > > > On Tue, 2008-07-08 at 23:48, Shi-Ying Irene Huang wrote: > > > >> Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI > >> This information is Copyright 2008 Sun Microsystems > >> 1. Introduction > >> 1.1. Project/Component Working Name: > >> gnome-keyring > >> 1.2. Name of Document Author/Supplier: > >> Author: Jeff Cai > >> 1.3 Date of This Document: > >> 08 July, 2008 > >> 4. Technical Description > >> 1. Introduction > >> 1.1. Project/Component Working Name: > >> > >> GNOME Keyring > >> > >> 1.2. Name of Document Author/Supplier: > >> > >> Author: Jeff Cai > >> Sponser: Irene Huang > >> > >> 1.3. Date of This Document: > >> > >> 07/09/2008 > >> > >> 1.4. Name of Major Document Customer(s)/Consumer(s): > >> > >> 1.4.1. The PAC or CPT you expect to review your project: > >> > >> Solaris PAC > >> > >> 1.4.2. The ARC(s) you expect to review your project: > >> > >> LSARC > >> > >> 1.4.3. The Director/VP who is "Sponsoring" this project: > >> > >> Robert O'Dea > >> > >> 1.4.4. The name of your business unit: > >> > >> Software - OPG > >> > >> 1.5. Email Aliases: > >> 1.5.1. Responsible Manager: harry.lu@sun.com > >> 1.5.2. Responsible Engineer: jeff.cai@sun.com > >> 1.5.3. Marketing Manager: > >> 1.5.4. Interest List: brian.cameron@sun.com > >> darren.moffat@sun.com > >> wyllys.ingersoll@sun.com > >> > >> 2. Project Summary > >> 2.1. Project Description: > >> > >> GNOME Keyring is a system to store passwords and other sensitive data in a > >> standardized way across all GNOME applications. > >> > >> A keyring stores a collection of encrypted passwords and encrypted > >> information about those passwords. A user can have multiple keyrings, each > >> for a different use, but there is a default one, called 'login'. There is > >> also a special 'session' keyring which is not stored on disk and goes away > >> when you log out. > >> > >> When a user logs into GNOME, the keyrings are locked and a master keyring > >> password has to be provided in order to unlock each of them. > >> > >> This fast-track increments the version of gnome-keyring in Solaris > >> from 2.20.3 to 2.22.3. > >> > >> 4. Technical Description: > >> > >> 4.1. Details: > >> > >> Compared with the previous version 2.20, following features have been added: > >> > >> - Basic X.509 certificate and key store. > >> - PKCS#11 module for accessing cerfificates and keys. > >> - Now includes an SSH agent. > >> - Automatically activate keyring daemon via DBus if it is not already > >> running. > >> - Add a simpler API fro accessing and storing passwords. Older APIs > >> exist too. Refer to [1] > >> > >> 4.2 GNOME Keyring SSH Agent > >> > >> GNOME Keyring includes an SSH agent which integrates with the gnome-keyring > >> and user login for its passwords. It can also use the main X.509 private > >> key store. > >> > >> GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it > >> starts up. > >> > >> The id_rsa and id_dsa files in ~/.ssh are automatically usable through the > >> SSH agent without first 'loading' them. Other X.509 private keys marked > >> with the 'ssh-authentication' purpose are also usable. > >> > >> Additional SSH keys can be manually loaded and managed via the ssh-add > >> command. > >> > >> If you use another SSH agent(such as the ssh-agent included with OpenSSH), > >> you may want to disable the SSH agent in GNOME Keyring to prevent ssh from > >> using it instead of your prefered SSH agent. You can set > >> /apps/gnome-keyring/daemon-components/ssh > >> gconf key to false. This prevents the SSH component of gnome-keyring from > >> starting up when the user logs in. > >> > >> The default GNOME start up script (/usr/dt/config/Xsession.jds) will be > >> changed to NOT start up "under" ssh-agent like it does today and instead > >> ensure the environment variables for the gnome-keyring version are set > >> early enough. > >> > >> 4.3 GNOME Keyring Certificates and Encryption Keys > >> > >> The following paths are searched for encryption keys and certificate files. > >> > >> - ~/.ssh/id_?sa > >> - ~/.gnome2/keystore/* > >> > >> Most standard file formats for keys and certificates are supported: > >> > >> Certificates > >> > >> * Standard DER encoded certificates. > >> * Certificates contained in PKCS#7 files. > >> * Certificates contained in PKCS#8 files. > >> * PEM encodings of the above. > >> > >> Encryption Keys > >> > >> * PKCS#1 RSA keys. > >> * PKCS#8 encrypted RSA and DSA keys. > >> * DER encoded DSA keys. > >> * PEM encodings of the above. > >> * OpenSSL PEM encrypted keys. > >> > >> File Encryption and Password Algorithms > >> > >> PKCS#5 PBE > >> > >> * DES CBC MD2 > >> * DES CBC MD5 > >> * DES CBC SHA1 > >> > >> PKCS#5 PBE2 > >> > >> * DES CBC SHA1 > >> * 3DES CBC SHA1 > >> * RC2-128 CBC SHA1 > >> > >> PKCS#12 PBE > >> > >> * RC4-128 STREAM SHA1 > >> * 3DES CBC SHA1 > >> * RC2-128 CBC SHA1 > >> * RC2-40 CBC SHA1 > >> > >> Supported crypto mechanisms include > >> > >> - DSA: sign/verify > >> - RSA: encrypt/decrypt sign/verify > >> > >> 4.4 GNOME Keyring Cryptoki (PKCS#11) Support > >> > >> PKCS#11 is a standard that lets applications use encryption keys and > >> certificates on devices like smart cards. gnome-keyring implements this > >> standard and acts such a device, storing keys and certificates and > >> making them available for applications to use. > >> > >> PKCS#11 deals directly with things like RSA/DSA signing operations, and > >> certificate attributes. It's a bit low level. Usually one uses PKCS#11 > >> through a cyrpto library like NSS. [5] > >> > >> PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform > >> the actual crypto operations, nowhere in the keyring/pkcs11 code do they > >> actually re-implement RSA or DSA key-generation or crypto functionality. > >> > >> > >> 4.5. Interfaces: > >> Exported Interfaces > >> Interface Classification Comments > >> --------------- -------------- ----------------------- > >> SUNWgnome-libs Uncommitted Package name (unchanged) > >> SUNWgnome-libs-devel Uncommitted Package name (unchanged) > >> > >> /usr/lib/libgnome-keyring.so Volatile Symbolic Link (unchanged) > >> /usr/lib/libgnome-keyring.so.0 Volatile SONAME (changed) > >> > >> > >> /us/share/gconf/schemas/ \ Volatile GCONF keys schemas that > >> gnome-keyring.schemas defines the preferences for > >> the tools (New) > >> > >> /usr/bin/gnome-keyring-daemon Volatile (unchanged) > >> /usr/lib/gnome-keyring-ask Project Private (unchanged) > >> > >> /usr/lib/gnome-keyring/ \ Volatile (New) > >> gnome-keyring-pkcs11.so > >> > >> /usr/lib/pkgconfig/ \ > >> gnome-keyring-1.pc Volatile (unchanged) > >> /usr/include/gnome-keyring-1/ \ > >> gnome-keyring.h Volatile (unchanged) > >> /usr/include/gnome-keyring-1/ \ > >> gnome-keyring-memory.h Volatile (unchanged) > >> /usr/include/gnome-keyring-1/ \ > >> gnome-keyring-result.h Volatile (unchanged) > >> > >> ~/.gnome2/keyrings Project Private Location where keyrings > >> are stored > >> > >> /usr/share/dbus-1/services/ \ Project > >> org.gnome.keyring.service Private DBus service file (New) > >> > >> org.gnome.keyrings.Daemon Volatile DBus interface > >> (session interface) > >> org.gnome.keyrings.Daemon \ > >> GetSocketPath Volatile DBus method, return > >> socket path. > >> Imported Interfaces > >> Interface Classification Comments > >> --------------- --------------- ----------------------- > >> GTK+ Committed LSARC/2008/207 > >> GLib Committed LSARC/2008/207 > >> D-Bus Volatile LSARC/2006/368 > >> libhal Volatile PSARC/2005/399 > >> libgcrypt Volatile LSARC/2008/354 > >> libtasn1 Volatile LSARC/2008/390 > >> > >> 4.6. Packaging & Delivery: > >> > >> No new packages are delivered. The two existing packages: > >> SUNWgnome-libs(base package) - base package for binaries > >> SUNWgnome-libs-devel (development package) - develoment package for > >> > >> 4.7 Security Impact: > >> > >> Please refer to [7]. > >> > >> 4.8 Dependencies: > >> > >> libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to > >> parse X509 certificate and general certificate. > >> > >> 5. References > >> [1] New API storing passwords: > >> http://live.gnome.org/GnomeKeyring/StoringPasswords > >> [2] Homepage: > >> http://live.gnome.org/GnomeKeyring > >> [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/ > >> [4] GNOME 2.14 ARC: LSARC/2006/202/ > >> [5] Configure other applications to use gnome-keyring certificates and keys: > >> http://live.gnome.org/GnomeKeyring/ApplicationSetup > >> [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki > >> [7] GNOME 2.14 security questionnaire: > >> http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt > >> > >> > >> 6. Resources and Schedule > >> 6.4. Steering Committee requested information > >> 6.4.1. Consolidation C-team Name: > >> Desktop > >> 6.5. ARC review type: FastTrack > >> 6.6. ARC Exposure: open > >> > >> > > > > > --Boundary_(ID_bjgGJ9nycXRYOD8mk7t8vQ) Content-type: text/html; charset=utf-8 Content-transfer-encoding: 7BIT John,

gnome-keyring is started at each label the user instantiates a workspace for.

Stephen.


On Thu, 2008-07-10 at 06:59, Jeff Cai wrote: 
John Fischer wrote:
> Jeff,
>
> Just a few questions...
>
> How does this work with Trusted Extensions?  Will there
> be a separate keyring per label?  Has this been answered
> previously in another ARC case?
>   
This issue has not been discussed before. I think Stephen Browne can 
give more about it.
>   
>>          /usr/lib/gnome-keyring/ \           Volatile         (New)
>>              gnome-keyring-pkcs11.so         
>>     
>
> This appears to be a Project Private library as it is
> hidden underneath /usr/lib/gnome-keyring directory.
> Is that correct?  If so then it should be declared as
> Project Private.
>   
As Darren has said, the library can be added by cryptoadm(1M) as a 
provider, so I'd like it to be a volatile interface.
> It appears from the document that the default behavior
> is to have the ssh agent turned off for Solaris.  Thus
> it will use OpenSSH.  Is that correct?
>   
Currently, ssh-agent is started in /usr/dt/config/Xsession.jds. Since 
gnome-session will also start gnome-keyring-daemon with ssh agent 
enabled, the start script of ssh-agent in Xsession.jds will be removed 
in case of the confliction.

Jeff
> Thanks,
>
> John
>
> On Tue, 2008-07-08 at 23:48, Shi-Ying Irene Huang wrote:
>   
>> Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI
>> This information is Copyright 2008 Sun Microsystems
>> 1. Introduction
>>     1.1. Project/Component Working Name:
>> 	 gnome-keyring
>>     1.2. Name of Document Author/Supplier:
>> 	 Author:  Jeff Cai
>>     1.3  Date of This Document:
>> 	08 July, 2008
>> 4. Technical Description
>> 1. Introduction
>>    1.1. Project/Component Working Name:
>>
>>         GNOME Keyring
>>
>>    1.2. Name of Document Author/Supplier:
>>         
>>         Author:         Jeff Cai
>>         Sponser:        Irene Huang
>>
>>    1.3. Date of This Document:
>>
>>         07/09/2008
>>
>>    1.4. Name of Major Document Customer(s)/Consumer(s):
>>
>>         1.4.1. The PAC or CPT you expect to review your project:
>>
>>                 Solaris PAC
>>
>>         1.4.2. The ARC(s) you expect to review your project:
>>
>>                 LSARC
>>
>>         1.4.3. The Director/VP who is "Sponsoring" this project:
>>
>>                 Robert O'Dea
>>
>>         1.4.4. The name of your business unit:
>>
>>                 Software - OPG
>>
>>    1.5. Email Aliases:
>>             1.5.1. Responsible Manager:  harry.lu@sun.com
>>             1.5.2. Responsible Engineer: jeff.cai@sun.com
>>             1.5.3. Marketing Manager:    
>>             1.5.4. Interest List:        brian.cameron@sun.com
>>                                          darren.moffat@sun.com
>>                                          wyllys.ingersoll@sun.com
>>
>> 2. Project Summary
>>    2.1. Project Description:
>>
>>    GNOME Keyring is a system to store passwords and other sensitive data in a 
>>    standardized way across all GNOME applications.
>>
>>    A keyring stores a collection of encrypted passwords and encrypted 
>>    information about those passwords. A user can have multiple keyrings, each 
>>    for a different use, but there is a default one, called 'login'. There is 
>>    also a special 'session' keyring which is not stored on disk and goes away 
>>    when you log out.
>>
>>    When a user logs into GNOME, the keyrings are locked and a master keyring 
>>    password has to be provided in order to unlock each of them.
>>
>>    This fast-track increments the version of gnome-keyring in Solaris
>>    from 2.20.3 to 2.22.3.
>>       
>> 4. Technical Description:
>>
>>     4.1. Details:
>>     
>>     Compared with the previous version 2.20, following features have been added:
>>
>>     - Basic X.509 certificate and key store.
>>     - PKCS#11 module for accessing cerfificates and keys.
>>     - Now includes an SSH agent.
>>     - Automatically activate keyring daemon via DBus if it is not already
>>       running.
>>     - Add a simpler API fro accessing and storing passwords. Older APIs 
>>       exist too. Refer to [1]
>>
>>     4.2 GNOME Keyring SSH Agent
>>
>>     GNOME Keyring includes an SSH agent which integrates with the gnome-keyring
>>     and user login for its passwords. It can also use the main X.509 private
>>     key store.
>>
>>     GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it 
>>     starts up.
>>
>>     The id_rsa and id_dsa files in ~/.ssh are automatically usable through the
>>     SSH agent without first 'loading' them. Other X.509 private keys marked 
>>     with the 'ssh-authentication' purpose are also usable.
>>
>>     Additional SSH keys can be manually loaded and managed via the ssh-add 
>>     command.
>>
>>     If you use another SSH agent(such as the ssh-agent included with OpenSSH), 
>>     you may want to disable the SSH agent in GNOME Keyring to prevent ssh from 
>>     using it instead of your prefered SSH agent. You can set 
>>     /apps/gnome-keyring/daemon-components/ssh
>>     gconf key to false. This prevents the SSH component of gnome-keyring from 
>>     starting up when the user logs in.
>>
>>     The default GNOME start up script (/usr/dt/config/Xsession.jds) will be 
>>     changed to NOT start up "under" ssh-agent like it does today and instead 
>>     ensure the environment variables for the gnome-keyring version are set 
>>     early enough. 
>>
>>     4.3 GNOME Keyring Certificates and Encryption Keys
>>    
>>     The following paths are searched for encryption keys and certificate files.
>>
>>          - ~/.ssh/id_?sa
>>          - ~/.gnome2/keystore/*
>>
>>     Most standard file formats for keys and certificates are supported:
>>
>>     Certificates
>>
>>         * Standard DER encoded certificates.
>>         * Certificates contained in PKCS#7 files.
>>         * Certificates contained in PKCS#8 files.
>>         * PEM encodings of the above. 
>>
>>     Encryption Keys
>>
>>         * PKCS#1 RSA keys.
>>         * PKCS#8 encrypted RSA and DSA keys.
>>         * DER encoded DSA keys.
>>         * PEM encodings of the above.
>>         * OpenSSL PEM encrypted keys. 
>>
>>     File Encryption and Password Algorithms
>>
>>     PKCS#5 PBE
>>
>>           * DES CBC MD2
>>           * DES CBC MD5
>>           * DES CBC SHA1 
>>
>>     PKCS#5 PBE2
>>
>>           * DES CBC SHA1
>>           * 3DES CBC SHA1
>>           * RC2-128 CBC SHA1 
>>
>>     PKCS#12 PBE
>>
>>           * RC4-128 STREAM SHA1
>>           * 3DES CBC SHA1
>>           * RC2-128 CBC SHA1
>>           * RC2-40 CBC SHA1
>>
>>     Supported crypto mechanisms include 
>>     
>>         - DSA: sign/verify
>>         - RSA: encrypt/decrypt sign/verify
>>
>>     4.4 GNOME Keyring Cryptoki (PKCS#11) Support
>>     
>>     PKCS#11 is a standard that lets applications use encryption keys and
>>     certificates on devices like smart cards. gnome-keyring implements this
>>     standard and acts such a device, storing keys and certificates and
>>     making them available for applications to use.
>>
>>     PKCS#11 deals directly with things like RSA/DSA signing operations, and
>>     certificate attributes. It's a bit low level. Usually one uses PKCS#11
>>     through a cyrpto library like NSS. [5]
>>
>>     PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform
>>     the actual crypto operations, nowhere in the keyring/pkcs11 code do they 
>>     actually re-implement RSA or DSA key-generation or crypto functionality. 
>>
>>
>>     4.5. Interfaces:
>>          Exported Interfaces
>>            Interface                        Classification      Comments
>>          ---------------                    -------------- -----------------------
>>          SUNWgnome-libs                      Uncommitted     Package name (unchanged)
>>          SUNWgnome-libs-devel                Uncommitted     Package name (unchanged)
>>
>>          /usr/lib/libgnome-keyring.so        Volatile        Symbolic Link (unchanged)
>>          /usr/lib/libgnome-keyring.so.0      Volatile        SONAME (changed)
>>
>>
>>          /us/share/gconf/schemas/ \          Volatile        GCONF keys schemas that 
>>              gnome-keyring.schemas                           defines the preferences for 
>>                                                              the tools (New)
>>                         
>>          /usr/bin/gnome-keyring-daemon       Volatile         (unchanged)
>>          /usr/lib/gnome-keyring-ask          Project Private  (unchanged)
>>
>>          /usr/lib/gnome-keyring/ \           Volatile         (New)
>>              gnome-keyring-pkcs11.so         
>>
>>          /usr/lib/pkgconfig/ \
>>               gnome-keyring-1.pc             Volatile         (unchanged)
>>          /usr/include/gnome-keyring-1/ \
>>               gnome-keyring.h                Volatile         (unchanged)
>>          /usr/include/gnome-keyring-1/ \
>>               gnome-keyring-memory.h         Volatile         (unchanged)
>>          /usr/include/gnome-keyring-1/ \
>>               gnome-keyring-result.h         Volatile         (unchanged)
>>
>>          ~/.gnome2/keyrings                  Project Private  Location where keyrings 
>>                                                               are stored
>>
>>          /usr/share/dbus-1/services/ \       Project
>>             org.gnome.keyring.service        Private          DBus service file (New)
>>
>>          org.gnome.keyrings.Daemon           Volatile         DBus interface 
>>                                                               (session interface)
>>          org.gnome.keyrings.Daemon \
>>             GetSocketPath                    Volatile         DBus method, return 
>>                                                               socket path.
>>          Imported Interfaces
>>            Interface              Classification     Comments
>>          ---------------        --------------- -----------------------
>>                GTK+              Committed         LSARC/2008/207       
>>                GLib              Committed         LSARC/2008/207       
>>                D-Bus             Volatile          LSARC/2006/368       
>>                libhal            Volatile          PSARC/2005/399
>>                libgcrypt         Volatile          LSARC/2008/354 
>>                libtasn1          Volatile          LSARC/2008/390
>>            
>>     4.6. Packaging & Delivery:
>>         
>>          No new packages are delivered. The two existing packages:
>>          SUNWgnome-libs(base package)                 - base package for binaries
>>          SUNWgnome-libs-devel (development package)   - develoment package for 
>>
>>     4.7 Security Impact:
>>         
>>         Please refer to [7]. 
>>
>>     4.8 Dependencies:
>>         
>>         libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to 
>>         parse X509 certificate and general certificate.
>>          
>> 5. References
>>         [1] New API storing passwords:
>>                 http://live.gnome.org/GnomeKeyring/StoringPasswords
>>         [2] Homepage:
>>                 http://live.gnome.org/GnomeKeyring
>>         [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/
>>         [4] GNOME 2.14 ARC: LSARC/2006/202/
>>         [5] Configure other applications to use gnome-keyring certificates and keys:
>>             http://live.gnome.org/GnomeKeyring/ApplicationSetup
>>         [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki
>>         [7] GNOME 2.14 security questionnaire: 
>>             http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt
>>
>>
>> 6. Resources and Schedule
>>     6.4. Steering Committee requested information
>>    	6.4.1. Consolidation C-team Name:
>> 		Desktop
>>     6.5. ARC review type: FastTrack
>>     6.6. ARC Exposure: open
>>
>>     
>
>
--Boundary_(ID_bjgGJ9nycXRYOD8mk7t8vQ)-- From Irene.Huang@sun.com Mon Jul 14 17:26:27 2008 Received: from sunmail4.singapore.sun.com (sunmail4.Singapore.Sun.COM [129.158.71.19]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m6F0QQGQ022193 for ; Mon, 14 Jul 2008 17:26:26 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail4.singapore.sun.com (8.13.4+Sun/8.13.3/ENSMAIL,v2.2) with ESMTP id m6F0QKMX006092 for <@sunmail2sca.sfbay.sun.com:LSARC-ext@sun.com>; Tue, 15 Jul 2008 08:26:25 +0800 (SGT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0K400070DUJWSP00@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 14 Jul 2008 18:26:20 -0600 (MDT) Received: from sineb-mail-2.sun.com ([192.18.19.7]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0K40005OJUJUYY20@brm-avmta-1.central.sun.com> for LSARC-ext@sun.com (ORCPT LSARC-ext@Sun.COM); Mon, 14 Jul 2008 18:26:19 -0600 (MDT) Received: from fe-apac-05.sun.com (fe-apac-05.sun.com [192.18.19.176] (may be forged)) by sineb-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id m6F0RNAm004509 for ; Tue, 15 Jul 2008 00:27:23 +0000 (GMT) Received: from conversion-daemon.mail-apac.sun.com by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) id <0K4000I01UCQN600@mail-apac.sun.com> (original mail from Irene.Huang@Sun.COM) for LSARC-ext@Sun.COM (ORCPT LSARC-ext@Sun.COM); Tue, 15 Jul 2008 08:25:47 +0800 (SGT) Received: from [129.158.217.138] by mail-apac.sun.com (Sun Java System Messaging Server 6.2-6.01 (built Apr 3 2006)) with ESMTPSA id <0K4000MDVUIWLRR1@mail-apac.sun.com>; Tue, 15 Jul 2008 08:25:46 +0800 (SGT) Date: Tue, 15 Jul 2008 08:26:59 +0800 From: Irene Huang Subject: Re: gnome-keyring [LSARC/2008/430 FastTrack timeout 07/15/2008] In-reply-to: <1216044446.56692.4.camel@sr1-edub-02> Sender: Irene.Huang@sun.com To: Stephen Browne Cc: Jeff Cai , John.Fischer@sun.com, Shi-Ying Irene Huang , LSARC-ext@sun.com, Brian Cameron , Darren J Moffat , Wyllys.Ingersoll@sun.com Message-id: <1216081619.1351.19.camel@goalie> MIME-version: 1.0 X-Mailer: Evolution 2.12.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 References: <200807090648.m696miK0026001@sac.sfbay.sun.com> <1215618789.5256.871.camel@sr1-umpk-11> <4875A53B.4060300@sun.com> <1216044446.56692.4.camel@sr1-edub-02> Status: RO Content-Length: 13470 If there's any more issues with this case, please raise in 24 hours. I'll close this case as approved tomorrow, if there's no more discussion. --Irene On Mon, 2008-07-14 at 15:07 +0100, Stephen Browne wrote: > John, > > gnome-keyring is started at each label the user instantiates a > workspace for. > > Stephen. > > > On Thu, 2008-07-10 at 06:59, Jeff Cai wrote: > > John Fischer wrote: > > > Jeff, > > > > > > Just a few questions... > > > > > > How does this work with Trusted Extensions? Will there > > > be a separate keyring per label? Has this been answered > > > previously in another ARC case? > > > > > This issue has not been discussed before. I think Stephen Browne can > > give more about it. > > > > > >> /usr/lib/gnome-keyring/ \ Volatile (New) > > >> gnome-keyring-pkcs11.so > > >> > > > > > > This appears to be a Project Private library as it is > > > hidden underneath /usr/lib/gnome-keyring directory. > > > Is that correct? If so then it should be declared as > > > Project Private. > > > > > As Darren has said, the library can be added by cryptoadm(1M) as a > > provider, so I'd like it to be a volatile interface. > > > It appears from the document that the default behavior > > > is to have the ssh agent turned off for Solaris. Thus > > > it will use OpenSSH. Is that correct? > > > > > Currently, ssh-agent is started in /usr/dt/config/Xsession.jds. Since > > gnome-session will also start gnome-keyring-daemon with ssh agent > > enabled, the start script of ssh-agent in Xsession.jds will be removed > > in case of the confliction. > > > > Jeff > > > Thanks, > > > > > > John > > > > > > On Tue, 2008-07-08 at 23:48, Shi-Ying Irene Huang wrote: > > > > > >> Template Version: @(#)sac_nextcase 1.66 04/17/08 SMI > > >> This information is Copyright 2008 Sun Microsystems > > >> 1. Introduction > > >> 1.1. Project/Component Working Name: > > >> gnome-keyring > > >> 1.2. Name of Document Author/Supplier: > > >> Author: Jeff Cai > > >> 1.3 Date of This Document: > > >> 08 July, 2008 > > >> 4. Technical Description > > >> 1. Introduction > > >> 1.1. Project/Component Working Name: > > >> > > >> GNOME Keyring > > >> > > >> 1.2. Name of Document Author/Supplier: > > >> > > >> Author: Jeff Cai > > >> Sponser: Irene Huang > > >> > > >> 1.3. Date of This Document: > > >> > > >> 07/09/2008 > > >> > > >> 1.4. Name of Major Document Customer(s)/Consumer(s): > > >> > > >> 1.4.1. The PAC or CPT you expect to review your project: > > >> > > >> Solaris PAC > > >> > > >> 1.4.2. The ARC(s) you expect to review your project: > > >> > > >> LSARC > > >> > > >> 1.4.3. The Director/VP who is "Sponsoring" this project: > > >> > > >> Robert O'Dea > > >> > > >> 1.4.4. The name of your business unit: > > >> > > >> Software - OPG > > >> > > >> 1.5. Email Aliases: > > >> 1.5.1. Responsible Manager: harry.lu@sun.com > > >> 1.5.2. Responsible Engineer: jeff.cai@sun.com > > >> 1.5.3. Marketing Manager: > > >> 1.5.4. Interest List: brian.cameron@sun.com > > >> darren.moffat@sun.com > > >> wyllys.ingersoll@sun.com > > >> > > >> 2. Project Summary > > >> 2.1. Project Description: > > >> > > >> GNOME Keyring is a system to store passwords and other sensitive data in a > > >> standardized way across all GNOME applications. > > >> > > >> A keyring stores a collection of encrypted passwords and encrypted > > >> information about those passwords. A user can have multiple keyrings, each > > >> for a different use, but there is a default one, called 'login'. There is > > >> also a special 'session' keyring which is not stored on disk and goes away > > >> when you log out. > > >> > > >> When a user logs into GNOME, the keyrings are locked and a master keyring > > >> password has to be provided in order to unlock each of them. > > >> > > >> This fast-track increments the version of gnome-keyring in Solaris > > >> from 2.20.3 to 2.22.3. > > >> > > >> 4. Technical Description: > > >> > > >> 4.1. Details: > > >> > > >> Compared with the previous version 2.20, following features have been added: > > >> > > >> - Basic X.509 certificate and key store. > > >> - PKCS#11 module for accessing cerfificates and keys. > > >> - Now includes an SSH agent. > > >> - Automatically activate keyring daemon via DBus if it is not already > > >> running. > > >> - Add a simpler API fro accessing and storing passwords. Older APIs > > >> exist too. Refer to [1] > > >> > > >> 4.2 GNOME Keyring SSH Agent > > >> > > >> GNOME Keyring includes an SSH agent which integrates with the gnome-keyring > > >> and user login for its passwords. It can also use the main X.509 private > > >> key store. > > >> > > >> GNOME Keyring will set the SSH_AUTH_SOCK environment variable when it > > >> starts up. > > >> > > >> The id_rsa and id_dsa files in ~/.ssh are automatically usable through the > > >> SSH agent without first 'loading' them. Other X.509 private keys marked > > >> with the 'ssh-authentication' purpose are also usable. > > >> > > >> Additional SSH keys can be manually loaded and managed via the ssh-add > > >> command. > > >> > > >> If you use another SSH agent(such as the ssh-agent included with OpenSSH), > > >> you may want to disable the SSH agent in GNOME Keyring to prevent ssh from > > >> using it instead of your prefered SSH agent. You can set > > >> /apps/gnome-keyring/daemon-components/ssh > > >> gconf key to false. This prevents the SSH component of gnome-keyring from > > >> starting up when the user logs in. > > >> > > >> The default GNOME start up script (/usr/dt/config/Xsession.jds) will be > > >> changed to NOT start up "under" ssh-agent like it does today and instead > > >> ensure the environment variables for the gnome-keyring version are set > > >> early enough. > > >> > > >> 4.3 GNOME Keyring Certificates and Encryption Keys > > >> > > >> The following paths are searched for encryption keys and certificate files. > > >> > > >> - ~/.ssh/id_?sa > > >> - ~/.gnome2/keystore/* > > >> > > >> Most standard file formats for keys and certificates are supported: > > >> > > >> Certificates > > >> > > >> * Standard DER encoded certificates. > > >> * Certificates contained in PKCS#7 files. > > >> * Certificates contained in PKCS#8 files. > > >> * PEM encodings of the above. > > >> > > >> Encryption Keys > > >> > > >> * PKCS#1 RSA keys. > > >> * PKCS#8 encrypted RSA and DSA keys. > > >> * DER encoded DSA keys. > > >> * PEM encodings of the above. > > >> * OpenSSL PEM encrypted keys. > > >> > > >> File Encryption and Password Algorithms > > >> > > >> PKCS#5 PBE > > >> > > >> * DES CBC MD2 > > >> * DES CBC MD5 > > >> * DES CBC SHA1 > > >> > > >> PKCS#5 PBE2 > > >> > > >> * DES CBC SHA1 > > >> * 3DES CBC SHA1 > > >> * RC2-128 CBC SHA1 > > >> > > >> PKCS#12 PBE > > >> > > >> * RC4-128 STREAM SHA1 > > >> * 3DES CBC SHA1 > > >> * RC2-128 CBC SHA1 > > >> * RC2-40 CBC SHA1 > > >> > > >> Supported crypto mechanisms include > > >> > > >> - DSA: sign/verify > > >> - RSA: encrypt/decrypt sign/verify > > >> > > >> 4.4 GNOME Keyring Cryptoki (PKCS#11) Support > > >> > > >> PKCS#11 is a standard that lets applications use encryption keys and > > >> certificates on devices like smart cards. gnome-keyring implements this > > >> standard and acts such a device, storing keys and certificates and > > >> making them available for applications to use. > > >> > > >> PKCS#11 deals directly with things like RSA/DSA signing operations, and > > >> certificate attributes. It's a bit low level. Usually one uses PKCS#11 > > >> through a cyrpto library like NSS. [5] > > >> > > >> PKCS#11 in gnome-keyring actually uses the libgcrypt crypto API to perform > > >> the actual crypto operations, nowhere in the keyring/pkcs11 code do they > > >> actually re-implement RSA or DSA key-generation or crypto functionality. > > >> > > >> > > >> 4.5. Interfaces: > > >> Exported Interfaces > > >> Interface Classification Comments > > >> --------------- -------------- ----------------------- > > >> SUNWgnome-libs Uncommitted Package name (unchanged) > > >> SUNWgnome-libs-devel Uncommitted Package name (unchanged) > > >> > > >> /usr/lib/libgnome-keyring.so Volatile Symbolic Link (unchanged) > > >> /usr/lib/libgnome-keyring.so.0 Volatile SONAME (changed) > > >> > > >> > > >> /us/share/gconf/schemas/ \ Volatile GCONF keys schemas that > > >> gnome-keyring.schemas defines the preferences for > > >> the tools (New) > > >> > > >> /usr/bin/gnome-keyring-daemon Volatile (unchanged) > > >> /usr/lib/gnome-keyring-ask Project Private (unchanged) > > >> > > >> /usr/lib/gnome-keyring/ \ Volatile (New) > > >> gnome-keyring-pkcs11.so > > >> > > >> /usr/lib/pkgconfig/ \ > > >> gnome-keyring-1.pc Volatile (unchanged) > > >> /usr/include/gnome-keyring-1/ \ > > >> gnome-keyring.h Volatile (unchanged) > > >> /usr/include/gnome-keyring-1/ \ > > >> gnome-keyring-memory.h Volatile (unchanged) > > >> /usr/include/gnome-keyring-1/ \ > > >> gnome-keyring-result.h Volatile (unchanged) > > >> > > >> ~/.gnome2/keyrings Project Private Location where keyrings > > >> are stored > > >> > > >> /usr/share/dbus-1/services/ \ Project > > >> org.gnome.keyring.service Private DBus service file (New) > > >> > > >> org.gnome.keyrings.Daemon Volatile DBus interface > > >> (session interface) > > >> org.gnome.keyrings.Daemon \ > > >> GetSocketPath Volatile DBus method, return > > >> socket path. > > >> Imported Interfaces > > >> Interface Classification Comments > > >> --------------- --------------- ----------------------- > > >> GTK+ Committed LSARC/2008/207 > > >> GLib Committed LSARC/2008/207 > > >> D-Bus Volatile LSARC/2006/368 > > >> libhal Volatile PSARC/2005/399 > > >> libgcrypt Volatile LSARC/2008/354 > > >> libtasn1 Volatile LSARC/2008/390 > > >> > > >> 4.6. Packaging & Delivery: > > >> > > >> No new packages are delivered. The two existing packages: > > >> SUNWgnome-libs(base package) - base package for binaries > > >> SUNWgnome-libs-devel (development package) - develoment package for > > >> > > >> 4.7 Security Impact: > > >> > > >> Please refer to [7]. > > >> > > >> 4.8 Dependencies: > > >> > > >> libtasn1 is a new imported interface. gnome-keyring makes use of libtasn1 to > > >> parse X509 certificate and general certificate. > > >> > > >> 5. References > > >> [1] New API storing passwords: > > >> http://live.gnome.org/GnomeKeyring/StoringPasswords > > >> [2] Homepage: > > >> http://live.gnome.org/GnomeKeyring > > >> [3] API document: http://library.gnome.org/devel/gnome-keyring/stable/ > > >> [4] GNOME 2.14 ARC: LSARC/2006/202/ > > >> [5] Configure other applications to use gnome-keyring certificates and keys: > > >> http://live.gnome.org/GnomeKeyring/ApplicationSetup > > >> [6] PCKS#11: http://live.gnome.org/GnomeKeyring/Cryptoki > > >> [7] GNOME 2.14 security questionnaire: > > >> http://sac.sfbay/LSARC/2006/202/updated.materials-3/security-questionnaire.txt > > >> > > >> > > >> 6. Resources and Schedule > > >> 6.4. Steering Committee requested information > > >> 6.4.1. Consolidation C-team Name: > > >> Desktop > > >> 6.5. ARC review type: FastTrack > > >> 6.6. ARC Exposure: open > > >> > > >> > > > > > >