mirrors/arti.git/doc/dev/notes/key-management-paths.md, branch arti-v1.9.0

doc/dev: Rename client authorization to restricted discovery.

2024-10-03T11:59:36Z

This renames "client auth" to "restricted discovery" where appropriate. Closes #1476

tor-hsclient: Remove client nickname from the client key specifiers.

2024-02-22T18:00:34Z

Closes #1283

dev doc: Lowercase the key paths.

2024-02-05T19:19:01Z

We changed all key paths to be lowercased a while ago, but forgot to update this document.

tor-hsservice: Rewrite maybe_generate_hsid using KeyMgr::generate.

2024-02-01T20:02:24Z

We will soon remove the `KeyMgr::*_with_derived()` functions, so we need to rewrite `maybe_generate_hsid` using `KeyMgr::get` and `KeyMgr::generate`. An important point to note is that `maybe_generate_hsid` no longer stores the `KP_hs_id` in the key store. The reason we originally put the `KP_hs_id` in the keystore in the first place was to support offline HsId mode. However, offline HsId mode was never fully implemented (#1194), and the decision to put the public part of the HsId in the keystore is controversial (#1195). We can revisit this decision when we implement #1194, but for now, we don't need a separate `KP_hs_Id` entry in the keystore.

tor-hsservice: Rename the service keystore dir to "hss".

2024-02-01T14:56:23Z

The onion service keys now live in the `hss/` subdirectory within the keystore. This layout change is **not** backwards-compatible, so if you want to use your existing hidden service keys, you will need to manually move them to `/hss`. Closes #1260

tor-keymgr: Strip .onion suffix from HsId before building Slug.

2024-01-31T10:43:06Z

We are about to replace `ArtiPathComponent` with `Slug`, but `Slug`s don't support `.`, so let's strip the `.onion` suffix before encoding it in the `ArtiPath`.

dev doc: Update keymgr paths to mention the new denotator separator.

2023-11-02T17:40:48Z

dev-doc: Document the service keys currently supported by keymgr.

2023-10-13T17:11:34Z

tor-keymgr: Encode whether the key is public or private in the file extension.

2023-10-13T17:11:28Z

There are 2 reasons to make this change: * because having the word `private` in the extension will make it more difficult to accidentally misuse or misplace a private key (see https://gitlab.torproject.org/tpo/core/arti/-/merge_requests/1618#note_2947461) * because `Keystore`s will soon grow a `list()` function returning all `(ArtiPath, KeyType)`s in the keystore, and in order for `ArtiNativeKeystore` to implement this function, it will need to be able to reverse the `KeyType -> file extension` mapping (if two different `KeyType`s are mapped to the same extension, `ArtiNativeKeystore`s won't be able to reverse the mapping)

dev docs: Document the `ArtiPath`s recognized by the key manager.

2023-09-14T13:04:19Z