Skip to content

Commit 23a83bf

Browse files
vasanthrajamsheathsvasanthrajams
authored
Mofnmodel (#10195)
* Adding 7.2-preview version (#8397) * Adding 7.2-preview version Signed-off-by: vasanthrajams <[email protected]> * Resolve PR feedback * Fix output-folder for go code generation Co-authored-by: Heath Stewart <[email protected]> * Change the number of certificates user provides for security domain This change modifies the number of certificates(containing public keys) customer needs to provide for encrypting the security domain to a M of N model. In this model, customer specifies the M certificates out of N certificates needed to restore the security domain. Signed-off-by: vasanthrajams <[email protected]> * prettier check * remove readyonly * Security domain object specification Signed-off-by: vasanthrajams <[email protected]> * internal review * prettier fix * model validation fixes * model validation * security domain id * Removing Security Domain ID * Fixed a few more specs * model validation failures * pretty check * changed tag * tag change Co-authored-by: Heath Stewart <[email protected]> Co-authored-by: vasanthrajams <[email protected]>
1 parent e773233 commit 23a83bf

File tree

5 files changed

+230
-25
lines changed

5 files changed

+230
-25
lines changed

‎custom-words.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1876,3 +1876,4 @@ watchlist
18761876
Watchlist
18771877
Mibps
18781878
ntfs
1879+
shamir_share

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.2-preview/examples/securitydomaindownloadpost-example.json‎

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"parameters": {
33
"vaultBaseUrl": "https://myvault.vault.azure.net/",
4-
"Certificates": {
4+
"CertificateInfoObject": {
55
"certificates": [
66
{
77
"value": {
@@ -60,14 +60,48 @@
6060
"e": "AQAB"
6161
}
6262
}
63-
]
63+
],
64+
"required": 2
6465
},
6566
"api-version": "7.2-preview"
6667
},
6768
"responses": {
6869
"200": {
6970
"body": {
70-
"value": "{\"EncData\":{\"data\":[{\"compact_jwe\":\"ey$Jhb%232GciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwia2lkIjoiZW5jbGF2ZS$J9..5eVwZFlsZQeYXQ11HPC_JJg.4d32grvkQBMxyGmncd82VHOggiFbtuaKX2wXvjU-vKukMAtS7oLl9QsSZZJ5s94xAz7Atye93e6gA_2tbHW0QEzLOXiuV-vZ342zP46dxV56bEEjENIOgzBWAfxUkuUdnYE2UDahGSJSbhNxo8URa44CaSAX682q_otmwqh0jgxk5ZcbHRdwpbSFZnfQ6SgHBqrvQUUpKlWJMJQNuWeEjmWaPkCOUnwkJ1ZLOnVj1AB8rlfj0qnEtBotc4V5066vztRDaTLEOV99lp08WRcRPAY2QVBSfhZdzslQ2baRukk6WOTI5KxIl0cf7o0db_zgoT6vluewXgzTSe6NTcrparwVJ-r6kxw12gkYJtrr3ytvOT_lgip5-7H3PLAgDDRDjHd_PEdNyPqsg56QjtVXBUwutQrfh46s_ATm0dFrhAF6Icf9H2rLDGCiFmKUn-CrtM3vErNzu9BMC8ekuSOe0t0XTnsKOjdiabE95MoRIqQYWQGfi02Rp2XO_lSEUnQJTNomd1IATKPiqqktE5YUu0OzDrVCdSGBGg5IDedmGSp0QIf8m7kSc8xYUsU1PTdJoSzgiOAue0ur_P1i2xr_BSSI6I4BJekw9e58qqBbWN-kc3swgLddsCfXqyW9RnNBvjQmnwdffv1O_4zF0wGVnohs6PYu-9RqIzLxgfHvnlBQbsauWlqpNfw5h_JpnoKW287vPc2iXRONHlGdd-4Mp3323JFbISM6NgGg8y6nUAdKASjyXuqR7bTnr3pNTpjF4523buuzKG3Q4nzr-jnWGPIpxeyBV6unEK0Aw3-QQpY7CG_s3-76P484gJm4vPum03I_V3tmnNt}]}}"
71+
"data": {
72+
"EncData": {
73+
"data": [
74+
{
75+
"compact_jwe": "<encrypted data1>",
76+
"tag": "hsm_backup"
77+
},
78+
{
79+
"compact_jwe": "<encrypted data2>",
80+
"tag": "base_enclave_backup"
81+
},
82+
{
83+
"compact_jwe": "<encrypted data3>",
84+
"tag": "partition_enclave_backup"
85+
}
86+
],
87+
"kdf": "sp108_kdf"
88+
},
89+
"SharedKeys": {
90+
"key_algorithm": "shamir_share",
91+
"required": 2,
92+
"enc_shares": [
93+
{
94+
"enc_key": "compact JWE wrapped share1",
95+
"x5t_256": "bWFuZ2VkaHNtDQo"
96+
},
97+
{
98+
"enc_key": "compact JWE wrapped share2",
99+
"x5t_256": "bWFuZ2VkaHNta2V5dmF1bHQNCg"
100+
}
101+
]
102+
},
103+
"version": 2
104+
}
71105
}
72106
}
73107
}

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.2-preview/examples/securitydomaintransferkey-example.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
"responses": {
77
"200": {
88
"body": {
9+
"key_format": "jwk",
910
"transfer_key": {
1011
"kid": "https://myvault.vault.azure.net/transfer_key",
1112
"kty": "RSA",

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.2-preview/examples/securitydomainuploadoperation-example.json‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,29 @@
22
"parameters": {
33
"vaultBaseUrl": "https://myvault.vault.azure.net/",
44
"security_domain": {
5-
"value": "<previously stored security domain>"
5+
"value": {
6+
"EncData": {
7+
"data": [
8+
{
9+
"compact_jwe": "<encrypted data1>",
10+
"tag": "hsm_backup"
11+
},
12+
{
13+
"compact_jwe": "<encrypted data2>",
14+
"tag": "base_enclave_backup"
15+
},
16+
{
17+
"compact_jwe": "<encrypted data3>",
18+
"tag": "partition_enclave_backup"
19+
}
20+
],
21+
"kdf": "sp108_kdf"
22+
},
23+
"WrappedKey": {
24+
"enc_key": "eyJhbGciOiJ",
25+
"x5t_256": "h8ObF2NU85MhzEEE2JrSSGcF7aK2CiNrffef1r8mY"
26+
}
27+
}
628
},
729
"api-version": "7.2-preview"
830
},

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.2-preview/securitydomain.json‎

Lines changed: 168 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -37,20 +37,20 @@
3737
"parameters": [
3838
{
3939
"in": "body",
40-
"name": "Certificates",
40+
"name": "CertificateInfoObject",
4141
"required": true,
4242
"schema": {
43-
"$ref": "#/definitions/CertificateSet"
43+
"$ref": "#/definitions/CertificateInfoObject"
4444
},
45-
"description": "Security domain download operation requires customer to provide three certificates containing public key in JWK format."
45+
"description": "Security domain download operation requires customer to provide N certificates (minimum 3 and maximum 10) containing public key in JWK format."
4646
},
4747
{
4848
"$ref": "#/parameters/ApiVersionParameter"
4949
}
5050
],
5151
"responses": {
5252
"200": {
53-
"description": "Security domain download response",
53+
"description": "This is the specification of the security domain as downloaded from the new pool",
5454
"schema": {
5555
"$ref": "#/definitions/SecurityDomainObject"
5656
}
@@ -120,7 +120,7 @@
120120
"description": "security domain",
121121
"required": true,
122122
"schema": {
123-
"$ref": "#/definitions/SecurityDomainObject"
123+
"$ref": "#/definitions/SecurityDomainUploadObject"
124124
}
125125
}
126126
],
@@ -185,17 +185,24 @@
185185
}
186186
},
187187
"definitions": {
188-
"CertificateSet": {
188+
"CertificateInfoObject": {
189189
"properties": {
190190
"certificates": {
191191
"type": "array",
192192
"items": {
193193
"$ref": "#/definitions/SecurityDomainCertificateItem"
194194
},
195195
"minItems": 3,
196-
"maxItems": 3,
196+
"maxItems": 10,
197197
"uniqueItems": true,
198-
"description": "Three certificates needed from customer"
198+
"description": "Certificates needed from customer"
199+
},
200+
"required": {
201+
"description": "Customer to specify the number of certificates (minimum 2 and maximum 10) to restore security domain",
202+
"type": "integer",
203+
"default": 2,
204+
"minimum": 2,
205+
"maximum": 10
199206
}
200207
},
201208
"required": [
@@ -215,8 +222,14 @@
215222
},
216223
"TransferKey": {
217224
"properties": {
225+
"key_format": {
226+
"type": "string",
227+
"default": "jwk",
228+
"description": "Specifies the format of the transfer key"
229+
},
218230
"transfer_key": {
219-
"$ref": "#/definitions/SecurityDomainJsonWebKey"
231+
"$ref": "#/definitions/SecurityDomainJsonWebKey",
232+
"description": "Specifies the transfer key in JWK format"
220233
}
221234
},
222235
"required": [
@@ -225,10 +238,113 @@
225238
},
226239
"SecurityDomainObject": {
227240
"properties": {
228-
"value": {
229-
"type": "string"
241+
"data": {
242+
"type": "object",
243+
"properties": {
244+
"EncData": {
245+
"$ref": "#/definitions/EncDataSet",
246+
"description": "Array of encrypted data set"
247+
},
248+
"SharedKeys": {
249+
"properties": {
250+
"key_algorithm": {
251+
"type": "string",
252+
"default": "shamir_share",
253+
"description": "The Algorithm used for shared keys"
254+
},
255+
"required": {
256+
"type": "integer",
257+
"minimum": 2,
258+
"maximum": 10,
259+
"description": "The number of keys (minimum 2 and maximum 10) required for security domain. "
260+
},
261+
"enc_shares": {
262+
"type": "array",
263+
"items": {
264+
"$ref": "#/definitions/Key",
265+
"minItems": 3,
266+
"maxItems": 10
267+
},
268+
"uniqueItems": true,
269+
"description": "Compact JWE wrapped shares array"
270+
}
271+
},
272+
"required": [
273+
"key_algorithm",
274+
"required",
275+
"enc_shares"
276+
],
277+
"description": "Array of shared keys"
278+
},
279+
"version": {
280+
"type": "integer"
281+
}
282+
},
283+
"required": [
284+
"EncData",
285+
"SharedKeys",
286+
"version"
287+
]
230288
}
231-
}
289+
},
290+
"description": "Security domain",
291+
"required": [
292+
"data"
293+
]
294+
},
295+
"EncDataSet": {
296+
"properties": {
297+
"data": {
298+
"type": "array",
299+
"items": {
300+
"$ref": "#/definitions/EncDataSetItem",
301+
"minItems": 2
302+
},
303+
"description": "Array of encrypted security domain",
304+
"uniqueItems": true
305+
},
306+
"kdf": {
307+
"type": "string",
308+
"default": "sp108_kdf",
309+
"description": "The key derivation function used"
310+
}
311+
},
312+
"required": [
313+
"data",
314+
"kdf"
315+
]
316+
},
317+
"EncDataSetItem": {
318+
"properties": {
319+
"compact_jwe": {
320+
"type": "string",
321+
"description": "Encrypted data"
322+
},
323+
"tag": {
324+
"type": "string",
325+
"description": "hsm backup tag"
326+
}
327+
},
328+
"required": [
329+
"compact_jwe",
330+
"tag"
331+
]
332+
},
333+
"Key": {
334+
"properties": {
335+
"enc_key": {
336+
"type": "string",
337+
"description": "Compact JWE wrapped share"
338+
},
339+
"x5t_256": {
340+
"type": "string",
341+
"description": "SHA 256 hash of certificate"
342+
}
343+
},
344+
"required": [
345+
"enc_key",
346+
"x5t_256"
347+
]
232348
},
233349
"SecurityDomainOperationStatus": {
234350
"properties": {
@@ -258,15 +374,7 @@
258374
},
259375
"kty": {
260376
"type": "string",
261-
"description": "JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40. For security domain this value must be RSA",
262-
"enum": [
263-
"RSA",
264-
"RSA-HSM"
265-
],
266-
"x-ms-enum": {
267-
"name": "JsonWebKeyType",
268-
"modelAsString": true
269-
}
377+
"description": "JsonWebKey Key Type (kty), as defined in https://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms-40. For security domain this value must be RSA"
270378
},
271379
"key_ops": {
272380
"type": "array",
@@ -310,12 +418,51 @@
310418
"required": [
311419
"kty",
312420
"key_ops",
421+
"alg",
313422
"kid",
314423
"x5c",
315424
"x5t#S256",
316425
"n",
317426
"e"
318427
]
428+
},
429+
"SecurityDomainUploadObject": {
430+
"properties": {
431+
"value": {
432+
"type": "object",
433+
"properties": {
434+
"EncData": {
435+
"$ref": "#/definitions/EncDataSet",
436+
"description": "Array of encrypted data set"
437+
},
438+
"WrappedKey": {
439+
"properties": {
440+
"enc_key": {
441+
"type": "string",
442+
"description": "Encryption key used to encrypt the EncData"
443+
},
444+
"x5t_256": {
445+
"type": "string",
446+
"description": "Thumbprint used to determine which certificate was used to encrypt the enc_key field"
447+
}
448+
},
449+
"required": [
450+
"enc_key",
451+
"x5t_256"
452+
],
453+
"description": "Key object containing the encryption key used to encrypt EncData object"
454+
}
455+
},
456+
"required": [
457+
"EncData",
458+
"WrappedKey"
459+
]
460+
}
461+
},
462+
"description": "Security domain object uploaded to a new pool",
463+
"required": [
464+
"value"
465+
]
319466
}
320467
},
321468
"parameters": {

0 commit comments

Comments
 (0)