Subject: [CDNi] Question on c-groupid & CDNI logging

From: Ben Niven-Jenkins <[email-masked]>
Date: Tue, 8 Dec 2015 19:47:07 +0000

CDNI logging authors,

I was reading the text for c-groupid in -20 of the CDNI logging draft and if I’ve understood correctly, the two CDNs setup a shared key which they rotate. c-groupid is encrypted using the shared key at the time the log line is generated (not when the log is transferred between CDNs? I’m guessing as the draft doesn’t say), which ties key rotation to log event generation, which is fine, but how do the CDNs synchronise their keys (how does a uCDN know the dCDN has rotated keys)?

Or do they rely on agreeing for example “we will start with key X at 21:00 UTC and rotate every 30 mins” (or whatever) and rely on the two CDNs being time sync’d (or the uCDN trying multiple keys for times around the rotation interval)?

The draft says this, but I’m not sure I know what it means
            At the agreed-upon lifetime, a new key is used, indicated by
            prefixing the key with a special character such as
            exclamation point.  In this way, shorter lifetimes can be
            used as needed.
Does that mean that ! is a “reserved” character within the element (are reserved characters really reserved or agreed out of band between the CDNs?) and used to signal “I’ve rotated keys”?

If a Surrogate is offline for a period of time, how does it indicate that it has rotated keys multiple times?

I’m also guessing you don’t really mean “prefixing the key”, I think you mean “prefixing the element”?

Thanks
Ben