| | 1 | |
| | 2 | {{{ |
| | 3 | #!html |
| | 4 | <H1>creddy</H1> |
| | 5 | <P> |
| | 6 | <A NAME="lbAB"> </A> |
| | 7 | <H2>NAME</H2> |
| | 8 | |
| | 9 | creddy - ABAC X.509 identity and attribute certificate manager |
| | 10 | <P> |
| | 11 | <A NAME="lbAC"> </A> |
| | 12 | <H2>SYNOPSIS</H2> |
| | 13 | |
| | 14 | <P> |
| | 15 | <B>creddy [ --<mode> ] --help</B> |
| | 16 | |
| | 17 | <P> |
| | 18 | <A NAME="lbAD"> </A> |
| | 19 | <H2>DESCRIPTION</H2> |
| | 20 | |
| | 21 | <P> |
| | 22 | creddy is an awesome and wonderful ABAC credential management tool. It |
| | 23 | creates, verifies, and otherwise frobnicates X.509 identity and |
| | 24 | attribute certificates. The output of the tool is suitable for use with |
| | 25 | ABAC. Additionally, the self-signed X.509 identity certs (with |
| | 26 | associated private keys) can be used with OpenSSL |
| | 27 | <P> |
| | 28 | <A NAME="lbAE"> </A> |
| | 29 | <H2>OPTIONS</H2> |
| | 30 | |
| | 31 | <P> |
| | 32 | <A NAME="lbAF"> </A> |
| | 33 | <H3>--generate</H3> |
| | 34 | |
| | 35 | Generate an X.509 identity cert and private key pair unless an external private key is specified. The certificate is saved in ${cn}_id.pem and the generated private key is saved in ${cn}_private.pem |
| | 36 | <P> |
| | 37 | <P> |
| | 38 | |
| | 39 | Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems |
| | 40 | <P> |
| | 41 | <DL COMPACT> |
| | 42 | <DT><B>--cn</B> |
| | 43 | |
| | 44 | <DD> |
| | 45 | common name used on certificate, provided as a convenience and ignored by ABAC |
| | 46 | <P> |
| | 47 | <DT><B>--validity</B> |
| | 48 | |
| | 49 | <DD> |
| | 50 | optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 1080 days |
| | 51 | <P> |
| | 52 | <DT><B>--out</B> |
| | 53 | |
| | 54 | <DD> |
| | 55 | optional output directory. Must exist before invoking the command |
| | 56 | <P> |
| | 57 | <DT><B>--key</B> |
| | 58 | <DD> |
| | 59 | optional external private key to be use for this identity |
| | 60 | <P> |
| | 61 | <DT><B>--p</B> |
| | 62 | |
| | 63 | <DD> |
| | 64 | optional passphrase flag if the external private key supplied is encrypted. If the passphrase |
| | 65 | is saved in a file 'pfile', then --p=pfile |
| | 66 | <P> |
| | 67 | </DL> |
| | 68 | <A NAME="lbAG"> </A> |
| | 69 | <H3>--verify</H3> |
| | 70 | |
| | 71 | verify the signature on a self-signed X.509 identity cert or an X.509 attribute cert |
| | 72 | <P> |
| | 73 | <DL COMPACT> |
| | 74 | <DT><B>--cert</B> |
| | 75 | |
| | 76 | <DD> |
| | 77 | self-signed X.509 identity cert |
| | 78 | <P> |
| | 79 | <DT><B>--attrcert</B> |
| | 80 | |
| | 81 | <DD> |
| | 82 | optional X.509 attribute cert. If omitted the self-signature of the ID cert is checked |
| | 83 | <P> |
| | 84 | </DL> |
| | 85 | <A NAME="lbAH"> </A> |
| | 86 | <H3>--keyid</H3> |
| | 87 | |
| | 88 | extract the subjectKeyIdentifier (SHA1 hash) from an X.509 identity cert |
| | 89 | <P> |
| | 90 | <DL COMPACT> |
| | 91 | <DT><B>--cert</B> |
| | 92 | |
| | 93 | <DD> |
| | 94 | X.509 identity cert |
| | 95 | <P> |
| | 96 | </DL> |
| | 97 | <A NAME="lbAI"> </A> |
| | 98 | <H3>--attribute</H3> |
| | 99 | |
| | 100 | generate an X.509 attribute cert representing an ABAC credential |
| | 101 | <P> |
| | 102 | An attribute cert has one or more subjects. A single subject may be defined without a role or oset. Otherwise, subjects are defined by a pair of a --subject-{cert,id} and --subject-{role,oset} and may include an optional --subject-link or just --subject-obj or --subject-cert. Providing multiple subjects creates an intersection certificate |
| | 103 | <P> |
| | 104 | <DL COMPACT> |
| | 105 | <DT><B>--issuer</B> |
| | 106 | |
| | 107 | <DD> |
| | 108 | X.509 identity cert issuing the credential |
| | 109 | <P> |
| | 110 | <DT><B>--key</B> |
| | 111 | |
| | 112 | <DD> |
| | 113 | private key associated with issuer cert |
| | 114 | <P> |
| | 115 | <DT><B>--p</B> |
| | 116 | |
| | 117 | <DD> |
| | 118 | optional passphrase if the private key is encrypted |
| | 119 | <P> |
| | 120 | <DT><B>--role</B> |
| | 121 | <DD> |
| | 122 | role in issuer's local attribute space |
| | 123 | <P> |
| | 124 | <DT><B>--oset</B> |
| | 125 | |
| | 126 | <DD> |
| | 127 | o-set in issuer's local attribute space |
| | 128 | <P> |
| | 129 | <DT><B>--subject-cert</B> |
| | 130 | |
| | 131 | <DD> |
| | 132 | X.509 identity cert representing the principal to which the role is being issued. This fulfills the same purpose as --subject-id and should only be used once per subject |
| | 133 | <P> |
| | 134 | <DT><B>--subject-id</B> |
| | 135 | |
| | 136 | <DD> |
| | 137 | public key identifier (SHA1 hash) of the principal to which the role is being issued. This fulfills the same purpose as --subject-cert and should only be used once per subject |
| | 138 | <P> |
| | 139 | <DT><B>--subject-role</B> |
| | 140 | <DD> |
| | 141 | optional role in subject's local attribute space. If the issuer is A, role is r1, subject is B, and subject-role is r2, the attribute issued will be A.r1 <- B.r2 |
| | 142 | <P> |
| | 143 | <DT><B>--subject-oset</B> |
| | 144 | |
| | 145 | <DD> |
| | 146 | optional oset in subject's local attribute space. If the issuer is A, oset is o1, subject is B, and subject-oset is o2, the attribute issued will be A.o1 <- B.o2 |
| | 147 | <P> |
| | 148 | <DT><B>--subject-link</B> |
| | 149 | |
| | 150 | <DD> |
| | 151 | optional linking role in subject's local attribute space. If the issuer is A, oset is o1, subject is B, subject-link is r2 and subject-oset is o2, the attribute issued will be A.o1 <- B.r2.o2 |
| | 152 | <P> |
| | 153 | <DT><B>--subject-obj</B> |
| | 154 | |
| | 155 | <DD> |
| | 156 | optional object in subject's local attribute space. If the issuer is A, oset is o1, and subject-obj is o2, the attribute issued will be A.o1 <- o2 |
| | 157 | <P> |
| | 158 | <DT><B>--validity</B> |
| | 159 | |
| | 160 | <DD> |
| | 161 | optional certificate validity. This argument takes a time period followed by an optional suffix of s m h d y (defaults to d if omitted). The default is 365 days |
| | 162 | <P> |
| | 163 | <DT><B>--out</B> |
| | 164 | |
| | 165 | <DD> |
| | 166 | where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der |
| | 167 | <P> |
| | 168 | </DL> |
| | 169 | <A NAME="lbAJ"> </A> |
| | 170 | <H3>--keycheck</H3> |
| | 171 | |
| | 172 | |
| | 173 | |
| | 174 | Do a sanity check on a private key file |
| | 175 | <P> |
| | 176 | <DL COMPACT> |
| | 177 | <DT><B>--key</B> |
| | 178 | |
| | 179 | <DD> |
| | 180 | private key to be used |
| | 181 | <P> |
| | 182 | <DT><B>--p</B> |
| | 183 | |
| | 184 | <DD> |
| | 185 | passphrase file to be used |
| | 186 | <P> |
| | 187 | </DL> |
| | 188 | <A NAME="lbAK"> </A> |
| | 189 | <H3>--roles</H3> |
| | 190 | |
| | 191 | Extract the roles from an X.509 attribute cert |
| | 192 | <P> |
| | 193 | <DL COMPACT> |
| | 194 | <DT><B>--cert</B> |
| | 195 | |
| | 196 | <DD> |
| | 197 | X.509 attribute cert containing ABAC roles |
| | 198 | <P> |
| | 199 | </DL> |
| | 200 | <A NAME="lbAL"> </A> |
| | 201 | <H3>--osets</H3> |
| | 202 | |
| | 203 | Extract the osets from an X.509 attribute cert |
| | 204 | <P> |
| | 205 | <DL COMPACT> |
| | 206 | <DT><B>--cert</B> |
| | 207 | |
| | 208 | <DD> |
| | 209 | X.509 attribute cert containing ABACosets |
| | 210 | <P> |
| | 211 | </DL> |
| | 212 | <A NAME="lbAM"> </A> |
| | 213 | <H3>--display</H3> |
| | 214 | |
| | 215 | Displays metadata from an X.509 identity or attribute cert |
| | 216 | <P> |
| | 217 | <DL COMPACT> |
| | 218 | <DT><B>--show=[issuer,..,all]</B> |
| | 219 | |
| | 220 | <DD> |
| | 221 | comma-separated list of: |
| | 222 | <P> |
| | 223 | <BR> issuer DN of issuer |
| | 224 | <BR> subject DN of subject |
| | 225 | <BR> validity validity period |
| | 226 | <BR> roles attribute cert roles (fails silently on ID certs) |
| | 227 | <BR> osets attribute cert osets (fails silently on ID certs) |
| | 228 | <BR> all all of the above |
| | 229 | <P> |
| | 230 | <DT><B>--cert</B> |
| | 231 | |
| | 232 | <DD> |
| | 233 | X.509 identity or attribute cert |
| | 234 | <P> |
| | 235 | </DL> |
| | 236 | <A NAME="lbAN"> </A> |
| | 237 | <H3>--version</H3> |
| | 238 | display ABAC/creddy version |
| | 239 | <P> |
| | 240 | <A NAME="lbAO"> </A> |
| | 241 | <H2>EXAMPLES</H2> |
| | 242 | |
| | 243 | <P> |
| | 244 | <DL COMPACT> |
| | 245 | <DT>Generate ID cert and private key pairs:<DD> |
| | 246 | <P> |
| | 247 | <B>creddy --generate --cn Alice</B> |
| | 248 | |
| | 249 | <BR> |
| | 250 | |
| | 251 | <B>creddy --generate --cn Bob</B> |
| | 252 | |
| | 253 | <P> |
| | 254 | <DT>Issue the credential Alice.friend <- Bob<DD> |
| | 255 | <P> |
| | 256 | creddy --attribute \ |
| | 257 | <BR> --issuer Alice_ID.pem --key Alice_private.pem \ |
| | 258 | <BR> --role friend --subject-cert Bob_ID.pem \ |
| | 259 | <BR> --out Alice_friend__Bob_attr.der |
| | 260 | <P> |
| | 261 | </DL> |
| | 262 | <A NAME="lbAP"> </A> |
| | 263 | <H2>AUTHOR</H2> |
| | 264 | |
| | 265 | <P> |
| | 266 | Written by Mike Ryan |
| | 267 | <BR> |
| | 268 | Updated by Mei-Hui Su <<A HREF="mailto:mei@ISI.EDU">mei@ISI.EDU</A>>. |
| | 269 | <P> |
| | 270 | <A NAME="lbAQ"> </A> |
| | 271 | <H2>BUGS</H2> |
| | 272 | |
| | 273 | <P> |
| | 274 | None yet. Report to <A HREF="http://abac.deterlab.net/">http://abac.deterlab.net/</A> |
| | 275 | <P> |
| | 276 | <A NAME="lbAR"> </A> |
| | 277 | <H2>COPYRIGHT</H2> |
| | 278 | |
| | 279 | <P> |
| | 280 | Copyright (c) 2010-2012 USC/ISI. Released under MIT license. See COPYING included with source for details. |
| | 281 | <P> |
| | 282 | }}} |
