Apps/WebApplicationReceipt/GenerationService: Difference between revisions

(NB to Marketplace team: If there is going to be a developer-facing API to query the state of individual receipts by user ID, it will need to have a developer-facing authentication piece.  This system does not require authentication; possession of the receipt is considered sufficient to find out the user's status).

The root signing nodes are responsible for generating a daily list of keys, certifying them with a hardware-protected private key.  They push these certified keys to the signing nodes through a secure, intranet-only link.  There is no internet access to the root signing nodes.  The public half of these keys is exported and delivered very carefully to the advertising point.

The Marketplace Verification service needs to receive the public keys, and to perform verification of the receipt and the certificate chain.

An attacker could capture a signing key and export it from the signing node.  They could make as many nodes as they like.

An attacker could compromise the channel through which the public keys are relayed from the root trust nodes to the distribution point, and place their own public key in the list.

* The public keys need to be advertised very securely; any tampering with this trust root enables receipt-impersonation attacks.