[zeromq-dev] State of zmq_msg_sender()/telling which client message belongs to which client (by curve cert name)

[Goswin von Brederlow]

On Thu, Apr 10, 2014 at 10:26:09AM +0200, Jonas Thiem wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi *,
> 
> With ZMQ 4, there is the powerful curve mechanism and the ironhouse
> pattern which allows cert-based client authentication.
> 
> My use case is that I have clients connecting, I want the connection
> to be secure AND I want to assign different application-level access
> rights to different clients, so I need to tell them apart (and a
> client must not impersonate another).
> 
> However, it seems I will need to put an entirely different
> authentication mechanism on top of that with independent, other
> secrets and authentication mechanisms unless I can tell WHICH client
> has actually sent a message to me. (and which certificate it used to
> connect)
> 
> That seems a bit pointless to me since it's all already there and
> cert-based authentication seems to be as secure as things can get -
> but I would simply need to know which client has sent which message
> (based on the certificate file name).
> 
> Reading this, it seems it was planned at some point to change this:
> http://grokbase.com/t/zeromq/zeromq-dev/135bcafzz0/message-source-identification-authentication
> 
> What is the state of that? Will this ever get added? Was it ever
> added? (also, to PyZMQ as well?)
> 
> All I would like to do is tell which client is speaking to me (based
> on the certificate name) so I don't need to put yet another full
> authentication thing with other passwords and stuff on top to tell
> them apart.
> 
> Regards,
> Jonas Thiem
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> 
> iQIcBAEBAgAGBQJTRlWcAAoJEBIDTbbx8Yke7IEQAOEYOBWElAv+vkGfntzhGkp1
> MWSnBEYtpRssEJ8oC6UGNfuXmmxUEZw5fPacTYeXpq7TcWUYFBz6sued9GvQDmhZ
> xrG29JF1KhUIQNVWfF6Z7FoXv3/6ItpKhg5M9/K7Dq370NNERHCEkCjIN4xJJKeT
> aHsk88O0eP7Afo6Ro3rBi2aFD0vKf/sa0Jb7FG+/NBvIZjCbj8OK5uG6vHZc/Xm+
> NFKzjLOUqQFLG80lWBzl4QiO0+uJKOO6/lX/UDgw9Ti8qWvACGVRWEAt8jvWxL2e
> IaezG4sUcCiSebTc4islXI8nFGye18fP6UmYk2g7wBYNrHtan5EBWf4989luV4bS
> 7NPgjB6w7OvdXf8yvz85fUX/TBUhsCI9gzYBjtwjPN+XJVkSTELusLSsInv+aC/G
> gobpyuBb5p7f7pd2b/+O5qJu8HTJ7t8uJoMt5TK20u5DH5VXXYCsvc+CEg4HrwIa
> gggB3e+lN60kwBG9MeBKjusvab7Cg86IpI5j1XRmgo2HJ9Z9O0Ni0vfDCfyP3EHx
> nAfn1vwk+7g4HsKluTy7WqVKoOWGMDRxyZVqJ0I+AhBKPRa6S76QiymXAX9hmjxC
> 3KqlepVcqi4UzRJzS6MyzXArbuvB1HYBXvBOpvJ1w/jCq2uoycO/rkyE1Al+/Htk
> DgbvduM6BCk6cugZ4SXH
> =3ets
> -----END PGP SIGNATURE-----

As mentioned on irc this is https://github.com/zeromq/libzmq/issues/802.
And the API already has stubs for it:
  https://github.com/zeromq/libzmq/blob/master/doc/zmq_msg_gets.txt

I will need this at work for the second next version of our software,
the upcoming release uses CURVE instead of a patched in ssl but keeps
a user/pass identification of clients on top of zmq. Getting that
released has precedence and after that I will have some time to do
more work on zmq. Out software also uses pyzmq so that should be the
first binding that gets support for it and gets tested.

MfG
	Goswin