You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2021/02/15 16:52:26 UTC
[GitHub] [pulsar] radiantone opened a new issue #9589: Consumers should not have access to private keys
radiantone opened a new issue #9589:
URL: https://github.com/apache/pulsar/issues/9589
The documentation refers to producers using public keys to encrypt data and consumers using private keys to decrypt data. This is backwards to how PKI normally works. Private keys are usually never disseminated (hence private). Public keys ARE shared in order to decrypt data from the private key holder.
In Pulsar docs this role reversal is confusing and apparently not the norm.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] codelipenghui commented on issue #9589: Consumers should not have access to private keys
Posted by GitBox <gi...@apache.org>.
codelipenghui commented on issue #9589:
URL: https://github.com/apache/pulsar/issues/9589#issuecomment-1058893193
The issue had no activity for 30 days, mark with Stale label.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] gaoran10 commented on issue #9589: Consumers should not have access to private keys
Posted by GitBox <gi...@apache.org>.
gaoran10 commented on issue #9589:
URL: https://github.com/apache/pulsar/issues/9589#issuecomment-812297782
@wmccarley I agree with your understanding.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Jennifer88huang edited a comment on issue #9589: Consumers should not have access to private keys
Posted by GitBox <gi...@apache.org>.
Jennifer88huang edited a comment on issue #9589:
URL: https://github.com/apache/pulsar/issues/9589#issuecomment-804552864
@wmccarley I agree with your understanding.
@gaoran10 @zymap could you please help double confirm the logic? Thank you.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Jennifer88huang commented on issue #9589: Consumers should not have access to private keys
Posted by GitBox <gi...@apache.org>.
Jennifer88huang commented on issue #9589:
URL: https://github.com/apache/pulsar/issues/9589#issuecomment-804552864
@wmccarley I agree with your understanding.
@gaoran10 @zymap could you please help double confirm?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] wmccarley commented on issue #9589: Consumers should not have access to private keys
Posted by GitBox <gi...@apache.org>.
wmccarley commented on issue #9589:
URL: https://github.com/apache/pulsar/issues/9589#issuecomment-787624931
I believe the documentation is correct but pki is not inherently intuitive... from Wikipedia entry for ‘Public-key cryptography’:
“...In such a system, any person can encrypt a message using the intended receiver's public key, but that encrypted message can only be decrypted with the receiver's private key.”
This implies that the recipient of the data is the responsible party for generating a key pair and thus the recipient shares public key with the sender.
The distinction between the ‘private’ key and the ‘public’ key is entirely semantic. If in your system the key pair is controlled by the producer then call the producer’s key the private.
FWIW Pulsar producer supports using multiple ‘public’ keys. Presumably this is so one-producer to many-consumer setup can utilize individual key pairs that are controlled by the consuming apps rather than the producer..
Someone can correct me if I’m wrong but this is my understanding.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org