Add ADR for waSCC Security Model and public-key signature system
ChrisRx opened this issue · 2 comments
waSCC currently implements security similar to that found in NATS 2.0, which relies on NKeys, an implementation of the ed25519 public-key signature system, to provide for authentication/authorization. waSCC uses a rust port of NKeys and keeps the similar ontology and raw key encoding specific to NKeys.
I am including links used during my own research into waSCC security:
- Edwards-Curve Digital Signature Algorithm (EdDSA)
- High-speed high-security signatures
- Introduction to NATS 2.0 Security
Important justification to include would be, for example, unique security and performance benefits of the ed25519 signature algorithm, reasoning for keeping the similar hierarchical roles introduced in NATS 2.0 (as well as for the ones added like Module and Service), and how such security roles map onto usage in waSCC (operators, accounts, users, etc). The practical usage example of these might be extremely helpful to illustrate usage, like as a user, what keys do I generate for a typical application and why. Another thing that should be detailed is if there is a stability guarantee around the roles or not (i.e. is it possible some will be added/removed and is there any guarantee of compatibility).
@autodidaddict this was closed by #4 right?
Correct.