26 lines
1.7 KiB
Markdown
26 lines
1.7 KiB
Markdown
# Hockeypuck Advanced Lookup Server
|
|
|
|
This server implements the WKD advanced hashing method for the 1337.berkeley.edu keyserver, something not implemented by default on the Hockeypuck Keyserver.
|
|
|
|
The primary distinction between the WKD and Hockeypuck is that the WKD lives
|
|
on the 1337.berkeley.edu domain and Hockeypuck runs on keys.1337.berkeley.edu
|
|
a domain which is not made public for security reasons (though this may
|
|
change in the future).
|
|
|
|
Public keys served from the WKD are done dynamically as requests are sent
|
|
to the /.well-known/ directory and then reformatted to match Hockeypuck's
|
|
query format, done entirely in NGINX. This works for username lookups, but
|
|
not for the advanced hashing methods which combines SHA1 and zbase32 hashing
|
|
methods as a form of lookup, notably with the /hu/ subdirectory. Checkout
|
|
the corresponding section in the [key management guide](https://wiki.1337.berkeley.edu/doku.php?id=public:guides:key_management) in the wiki for more information and examples.
|
|
|
|
This server sits between NGINX and Hockeypuck. It creates a list of hashed
|
|
usernames generated from the LDAP server and stores them as a key, and their
|
|
values are the corresponding un-hashed usernames. When it recieves a request
|
|
with a hash, it looks up the corresponding username and then resends the
|
|
request to the basic username lookup endpoint and passes the resulting
|
|
public key back. This works since the Hockeypuck server only supports username
|
|
look ups, so no further modification needs to happen Hockeypuck's side.
|
|
|
|
`[User makes request to /hu/] -> [NGINX forwards to HAL] -> [HAL finds associated username to the hash, sends request to Hockeypuck] -> [Hockeypuck returns public key]`
|