You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We do know all S3 gateway nodes so we can use owners in bearer tokens and to properly use them we need to use node-specific key in each encrypted token which means that we can't generate/sign token first and then encrypt the same token for all nodes. So some interfaces need to be changed and adapted for this scheme, but that's what we need to have in the end for proper gateway functioning.
@roman-khimov There is some problem with using different bearer tokens. Since SecretAccessKey (aws credentials) is calculated as hash from token we will get different keys for different gates.
Then we need to fix it also. Access key being a hash means that anyone seeing this token (any NeoFS node) automatically knows the access key which doesn't seem right to me. What we can do instead is choose some random key and add it into the access box, then encrypt it along with tokens (maybe as a separate AccessBox field).
We do know all S3 gateway nodes so we can use owners in bearer tokens and to properly use them we need to use node-specific key in each encrypted token which means that we can't generate/sign token first and then encrypt the same token for all nodes. So some interfaces need to be changed and adapted for this scheme, but that's what we need to have in the end for proper gateway functioning.
This better be done after #75.
The text was updated successfully, but these errors were encountered: