Changes between Version 3 and Version 4 of SignatureCheck

Timestamp:

Feb 7, 2021, 11:29:31 PM (4 years ago)

Author:

4juergen

Comment:

--

SignatureCheck

@@ -8 +8 @@
 The SignatureCheck Plugin does this for Plugins and the NetSigner Plugin for Nets.
 
-'''Here we provide a download for reviewers: TODO'''
+'''Here we provide a download for reviewers: [https://git.informatik.uni-hamburg.de/tgipublic/signed-renew/-/archive/master/signed-renew-master.zip Download]'''
 
 == Installation ==
@@ -55 +55 @@
 Unknown third parties can't disguise themself as trusted authors.
 
+=== Output of the Plugin ===
+After a successful installation the plugin will print {{{INFO: SignatureCheck: Listener added to Loader.}}} to the console when Renew starts.
+
+Plugins where the file does not match the signature don't get loaded.
+These plugins could be manipulated.
+Please reinstall the plugin with its signature.
+
+[[Image(Corrupted.PNG)]]
+
+The number of trusted authors is very limited by default (only the key from the automatic Renew builds).
+Any unknown Key will raise an Error.
+This Error includes the file location and the [https://en.wikipedia.org/wiki/Pretty_Good_Privacy PGP] fingerprint.
+The fingerprint can be used to search the key on a key server.
+It is recommended  to ask the author directly for their public key, so it is the key from the author and not from an imposter.
+
+[[Image(Untrusted.PNG)]]
+
+=== Adding additional trusted keys ===
+All trusted keys are stored in the {{{config/publickey.pgp}}} file.
+This file is a concatenation of all trusted public keys.
+So, adding a new trusted public key is simply appending it.
+
+The following commands add the key.pgp file to the publickey.pgp.
+All commands are meant to be executed inside the config folder.
+
+Windows has the cmd program named copy, which can copy binary data from multiple files into one.
+
+  COPY /B .\publickey.pgp + .\key.pgp .\publickey.pgp
+
+Linux and MacOS have a program named cat, which works similar.
+
+  cat publickey.pgp key.pgp > publickey.pgp
+
 == NetSigner Plugin ==
 Renews Net Drawings can contain Java code.
@@ -75 +108 @@
 A storage or transmittion error can also be detected as manipulation, but cannot be fixed by this format.
 
+=== Getting a Certificate ===
+First choose a [https://en.wikipedia.org/wiki/Certificate_authority Certificate Authority (CA)], which will verify the identity to other users.
+A list of trusted CAs is available in the file doc/trusted.txt of the release.
+This plugin needs a X.509 Code Signing Certificate or a X.509 personal E-Mail Certificate.
+Each CA has different requirements on how to request a certificate.
+
+One standardized way to get a certificate is a CSR which can be created with this plugin.
+This feature is in the menu under Plugins -> Net Signature ->; New CSR.
+
+[[Image(menu.PNG)]]
+
+Input here all information needed by the CA and click on the "Generate CSR" button.
+This will write a CSR to the chosen location and save the private key into the KeyStore.
+You will get asked for a Password, which will protect your private key.
+Send the CSR to the CA.
+The CA will generate a certificate chain for the private key which can be imported with the Plugins -> Net Signature -> Import certificate chain menu entry.
+The signing part of this plugin is ready once the certificate chain has been imported.
+
+Please make sure that the NetSigner Plugin is placed in the Renew plugin folder if the "Net Signature" sub menu is missing.
+If the "New CSR" or "Import certificate chain" menu entry does not exist, follow the steps under User Guide.
+
+If the CA has its own tools to request a Certificate, use those.
+These usually produce a PKCS#12 file, which holds a private key and its certificates.
+To import a PKCS#12 file use the Plugins -> Net Signature -> Import PKCS#12 file menu entry.
+This step will ask for three passwords.
+The first password is the password of the PKCS#12 file.
+The second password is the password for the KeyStore (will be set on first time entering a KeyStore password).
+The third password is the new password for the freshly imported key.
+
+=== Signing a Net Drawing ===
+[[Image(menuExport.PNG)]]
+
+The signing function is under File -> Export -> Export current drawing -> SignedNetDrawing current drawing.
+
+You will get asked for your passwords the first time you sign a Net Drawing with each Renew instance.
+These are the KeyStore and private key passwords from the import.
+
+=== Getting Signature Information ===
+Best practice is to check the identity of the signer before opening the net.
+This is possible with the menu option Plugins -> Net Signature -> Show signer of file.
+
+The net will not be interpreted in this mode, it only checks the signature of the file and displays the signer information.
+
+The important part is the Signer portion.
+Here is the name of the author of the net.
+Additionally, the first line under more information includes country code, city, E-Mail and any other information which are known about the author.
+The lines under that show the CAs.
+These can be important inside a corporation/institute where the right CA for the author might be known.
+
+=== Loading a signed Net Drawing ===
+
+The loading functionality is under File -> Import -> SignedNetDrawing.
+This will load the Net Drawing if the signature is correct and trusted.
+
+Information about the signer can be viewed under Plugins -> Net Signature -> Show current signature.
+
 == Further reading ==