[zeromq-dev] State of zmq_msg_sender()/telling which client message belongs to which client (by curve cert name)

[Pieter Hintjens]

I've written the API for this, zmq_msg_gets(), and there is an issue
somewhere with discussion of how to implement it. That plumbing is
beyond my skill though.

On Thu, Apr 10, 2014 at 10:26 AM, Jonas Thiem <jonasthiem at googlemail.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi *,
>
> With ZMQ 4, there is the powerful curve mechanism and the ironhouse
> pattern which allows cert-based client authentication.
>
> My use case is that I have clients connecting, I want the connection
> to be secure AND I want to assign different application-level access
> rights to different clients, so I need to tell them apart (and a
> client must not impersonate another).
>
> However, it seems I will need to put an entirely different
> authentication mechanism on top of that with independent, other
> secrets and authentication mechanisms unless I can tell WHICH client
> has actually sent a message to me. (and which certificate it used to
> connect)
>
> That seems a bit pointless to me since it's all already there and
> cert-based authentication seems to be as secure as things can get -
> but I would simply need to know which client has sent which message
> (based on the certificate file name).
>
> Reading this, it seems it was planned at some point to change this:
> http://grokbase.com/t/zeromq/zeromq-dev/135bcafzz0/message-source-identification-authentication
>
> What is the state of that? Will this ever get added? Was it ever
> added? (also, to PyZMQ as well?)
>
> All I would like to do is tell which client is speaking to me (based
> on the certificate name) so I don't need to put yet another full
> authentication thing with other passwords and stuff on top to tell
> them apart.
>
> Regards,
> Jonas Thiem
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQIcBAEBAgAGBQJTRlWcAAoJEBIDTbbx8Yke7IEQAOEYOBWElAv+vkGfntzhGkp1
> MWSnBEYtpRssEJ8oC6UGNfuXmmxUEZw5fPacTYeXpq7TcWUYFBz6sued9GvQDmhZ
> xrG29JF1KhUIQNVWfF6Z7FoXv3/6ItpKhg5M9/K7Dq370NNERHCEkCjIN4xJJKeT
> aHsk88O0eP7Afo6Ro3rBi2aFD0vKf/sa0Jb7FG+/NBvIZjCbj8OK5uG6vHZc/Xm+
> NFKzjLOUqQFLG80lWBzl4QiO0+uJKOO6/lX/UDgw9Ti8qWvACGVRWEAt8jvWxL2e
> IaezG4sUcCiSebTc4islXI8nFGye18fP6UmYk2g7wBYNrHtan5EBWf4989luV4bS
> 7NPgjB6w7OvdXf8yvz85fUX/TBUhsCI9gzYBjtwjPN+XJVkSTELusLSsInv+aC/G
> gobpyuBb5p7f7pd2b/+O5qJu8HTJ7t8uJoMt5TK20u5DH5VXXYCsvc+CEg4HrwIa
> gggB3e+lN60kwBG9MeBKjusvab7Cg86IpI5j1XRmgo2HJ9Z9O0Ni0vfDCfyP3EHx
> nAfn1vwk+7g4HsKluTy7WqVKoOWGMDRxyZVqJ0I+AhBKPRa6S76QiymXAX9hmjxC
> 3KqlepVcqi4UzRJzS6MyzXArbuvB1HYBXvBOpvJ1w/jCq2uoycO/rkyE1Al+/Htk
> DgbvduM6BCk6cugZ4SXH
> =3ets
> -----END PGP SIGNATURE-----
> _______________________________________________
> zeromq-dev mailing list
> zeromq-dev at lists.zeromq.org
> http://lists.zeromq.org/mailman/listinfo/zeromq-dev