Re: Pyro4 and connection authentication

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 26-6-2012 0:44, Hilary Oliver wrote:

> When I started developing cylc I knew (and still know) next to nothing about
> networking, but Pyro allowed me to get the required client/server functionality
> working very quickly and easily in spite of my ignorance :-)

That's great to hear!

And thanks for answering my questions. It helps a lot to consider when and how the
connection authentication feature can be added to Pyro4.

The next release (4.15) will contain the sorely needed fix for the threadpool lockup
problem (and some other minor changes). I will release this first.
The version after that, 4.16, can be the first to contain a connection authentication
feature similar to that what Pyro3 has.
I'm not sure yet what the fate of the HMAC authentication will be.


>> Have you looked at the HMAC key that Pyro4 can require for 'authorized' 
>> connections? How useful (or silly) is that for your situation?
> 
> My impression is that this is "less secure" than the Pyro3 connection 
> authentication as the key goes over the wire unencrypted - is that right?  If so,
> it may still be sufficient as an interim measure

This impression is wrong, the key itself is private and it is only used to construct a
HMAC digest of the transmitted data. They key is never transmitted.
Then again, it's only as secure as your source code is (unless you have a clever way
to provide your program with a secure secret key that's not written in the source code
- -- Pyro doesn't provide such a feature at this time).

By the way, on http://hjoliver.github.com/cylc/#acknowledgements there's a footnote
about Pyro4 not being recommended for production use. That statement has been false
for quite a while now. ;-)


Irmen.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJP6f/QAAoJEHC9o7RHFlf2cokH/1yxgwgne702FmUADsY2Nf5c
39VBY8Sy7cN6LcUTpTfhlwsFMTM8rDUrjG4MbtMYYmXD9bD753YpUH81kc6XprpG
57/84LkfSWkdQf4H3dhjiiJeioPlubFE8GIM1fiErxXYeQJzlYHvmwfGdozZsraP
gO0ctd0SDphuKpM1hCACVXnYwd2R2Yo0W+yb8Bu83BmuOYmKDo1sUdE2LxIp0X83
IocR3dfoaUkWHb6+q+DxzF8jl9MsFpUAiakandD6kTVy5rLfQ68C+oeU5lu613R/
xtW3Q2J9ruu555hVQNBvoykZBgDHdFNbAdnhwcD/Vxvg7ugdWJ0Wl9IgSWAyRGU=
=6TuH
-----END PGP SIGNATURE-----

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/