"core": Server authentication during VC handshake
Currently, during VC establishment, a client always shares all
its blessings that are tagged for the server irrespective of
any server-authentication checks specified for the call (e.g.,
ServerPublicKey, AllowedServersPolicy, etc). Thus clients end up
revealing their identity to unauthenticated servers.
This CL addresses the issue by enforcing all server authentication checks
during VC handshake. These checks are ones specified for the call that
initiated the handshake.
Furthermore, since clients specify their blessings during each flow, we
modify the VC handshake so that clients only shares a self-signed
blessing during the handshake. The purpose of this blessing is to reveal
the public key of the client to the server. The server ensures that
all blessings revealed during flows are bound to this public key.
Change-Id: Ib43b37867dbcce5db065a831621788403e74ad2c
18 files changed
