| [f1817a9] | 1 | Acme runs a testbed. They've delegated the authority to create |
|---|
| 2 | experiments to all their partners. The Globotron company is one such |
|---|
| 3 | partner. |
|---|
| 4 | |
|---|
| 5 | Acme.experiment_create <- Acme.partner.experiment_create |
|---|
| 6 | Acme.partner <- Globotron |
|---|
| 7 | |
|---|
| 8 | Globotron has delegated the authority to anyone an admin thinks is a |
|---|
| 9 | 'power user'. |
|---|
| 10 | |
|---|
| 11 | Globotron.experiment_create <- Globotron.admin.power_user |
|---|
| 12 | |
|---|
| 13 | Alice is an admin, and her friend Bob is a power user: |
|---|
| 14 | |
|---|
| 15 | Globotron.admin <- Alice |
|---|
| 16 | Alice.power_user <- Bob |
|---|
| 17 | |
|---|
| 18 | From these credentials, it is possible to construct a proof graph |
|---|
| 19 | showing that Acme.experiment_create <- Bob. |
|---|
| 20 | |
|---|
| 21 | Note that there is a one-to-one correspondence with each credential |
|---|
| 22 | above and the attribute certificates below. |
|---|
| 23 | |
|---|
| 24 | creddy --generate --cn Acme |
|---|
| 25 | |
|---|
| 26 | creddy --generate --cn Globotron |
|---|
| 27 | |
|---|
| 28 | creddy --generate --cn Alice |
|---|
| 29 | |
|---|
| 30 | creddy --generate --cn Bob |
|---|
| 31 | |
|---|
| 32 | creddy --attribute \ |
|---|
| 33 | --issuer Acme_ID.pem --key Acme_private.pem --role experiment_create \ |
|---|
| 34 | --subject-cert Acme_ID.pem --subject-role partner.experiment_create \ |
|---|
| 35 | --out Acme_experiment_create__Acme_partner_experiment_create_attr.der |
|---|
| 36 | |
|---|
| 37 | creddy --attribute \ |
|---|
| 38 | --issuer Acme_ID.pem --key Acme_private.pem --role partner \ |
|---|
| 39 | --subject-cert Globotron_ID.pem \ |
|---|
| 40 | --out Acme_partner__Globotron_attr.der |
|---|
| 41 | |
|---|
| 42 | creddy --attribute \ |
|---|
| 43 | --issuer Globotron_ID.pem --key Globotron_private.pem --role experiment_create \ |
|---|
| 44 | --subject-cert Globotron_ID.pem --subject-role admin.power_user \ |
|---|
| 45 | --out Globotron_experiment_create__Globotron_admin_power_user_attr.der |
|---|
| 46 | |
|---|
| 47 | creddy --attribute \ |
|---|
| 48 | --issuer Globotron_ID.pem --key Globotron_private.pem --role admin \ |
|---|
| 49 | --subject-cert Alice_ID.pem \ |
|---|
| 50 | --out Globotron_admin__Alice_attr.der |
|---|
| 51 | |
|---|
| 52 | creddy --attribute \ |
|---|
| 53 | --issuer Alice_ID.pem --key Alice_private.pem --role power_user \ |
|---|
| 54 | --subject-cert Bob_ID.pem \ |
|---|
| 55 | --out Alice_admin__Bob_attr.der |
|---|
