Add key management documentation for MSI v2 #5513
Conversation
Document the key management logic and responsibilities in MSI v2, including key selection priorities and flow.
|
|
||
| ## Key Responsibilities | ||
|
|
||
| - Generate and hold the RSA private key. |
There was a problem hiding this comment.
what does "hold" mean?
There was a problem hiding this comment.
+1 ... and to generalize the concept, we should have some Windows / Linux notes .. I assume on Windows "hold" means "write to it a keystore" and on Linux means "write it to memory"
| - Generate and hold the RSA private key. | ||
| - Ensure the key is protected to the maximum capability of the platform. | ||
| - Provide the key for signing (CSR, PoP requests, mTLS handshakes). | ||
| - Never allow export if backed by hardware/KeyGuard. |
| - Requires Virtualization-Based Security (VBS). | ||
| - Keys are isolated in a secure enclave. | ||
| - Strongest guarantee that the private key cannot be exfiltrated. | ||
| - Used for Proof-of-Possession (PoP). |
There was a problem hiding this comment.
Why did you only put this here and not the other key types? Every Key type listed here can be used in PoP.
| ### Hardware / TPM / KSP (fallback) | ||
|
|
||
| - Keys are backed by TPM or the Platform Crypto Provider. | ||
| - Non-exportable, tied to the device. |
There was a problem hiding this comment.
KeyGuard is also not exportable, can you add this to the KeyGuard section too?
| - Strongest guarantee that the private key cannot be exfiltrated. | ||
| - Used for Proof-of-Possession (PoP). | ||
|
|
||
| ### Hardware / TPM / KSP (fallback) |
There was a problem hiding this comment.
Can you write out the TPM acronym here?
| KeyProvider-->>KeyProvider: Acquire semaphore | ||
| alt KeyGuard available | ||
| KeyProvider-->>MSAL: KeyGuard key (preferred) | ||
| else Hardware/TPM available |
There was a problem hiding this comment.
add "KeyGuard not available"
| else Hardware/TPM available | ||
| KeyProvider-->>MSAL: Hardware key | ||
| else | ||
| KeyProvider-->>MSAL: In-memory RSA key |
There was a problem hiding this comment.
add "KeyGuard and TPM not available"
Co-authored-by: Bogdan Gavril <bogavril@microsoft.com>
3 participants
Document the key management logic and responsibilities in MSI v2, including key selection priorities and flow.