Discover Top Posts Tagged with #spiffe

IETF AIMS: How AI Agents Authenticate with SPIFFE and OAuth 2.0

🔐 The IETF just published draft-klrc-aiagent-auth-00 — the first standardized framework for AI agent identity. AIMS (Agent Identity Management System) composes SPIFFE + WIMSE + OAuth 2.0 into 8 layers: 1️⃣ Agent Identifier (SPIFFE URI) 2️⃣ Credentials (short-lived X.509/JWT) 3️⃣ Attestation (hardware + software proof) 4️⃣ Credential Provisioning (auto-rotate) 5️⃣ Authentication (mTLS or WPT) 6️⃣ Authorization (OAuth 2.0) 7️⃣ Monitoring (real-time signals) 8️⃣ Policy Why it matters: 53% of MCP servers use static API keys. AIMS calls this "an antipattern for agent identity." With EU AI Act compliance due August 2026, this is the reference architecture. Full breakdown 👇 #AIAgentSecurity #OAuth #SPIFFE #IAM #IdentitySecurity #IETF #AISecurity #MCP #ZeroTrust Read more: IETF AIMS: How AI Agents Authenticate with SPIFFE and OAuth 2.0

#AI Agent Security #OAuth #SPIFFE #IAM

Projects are used by leading cloud native companies including Bloomberg, ByteDance, Pinterest, and Twilio, among others San Francisco, CA – September 20, 2022 – The Cloud Native Computing Foundation®…

Got workload attestation?

#CNCF #SPIFFE #SPIRE

Big news, small pull request. SPIFFE/SPIRE is now a graduated CNCF project! https://github.com/spiffe/spire/pull/3405

#SPIFFE #SPIRE #CNCF

HPE is a CNCF silver member with projects in Cloud Native Storage, Certified Kubernetes Distributions and recently Kubernetes Certified Service Provider. Recent acquisition of Scytale obtained SPIFFE and SPIRE in Key Management.

#HPE #CNCF #Kubernetes #Scytale #SPIFFE #SPIRE

Traditional zone-based security approaches that worked well in the data center for the past 30 years struggle with elastically-scaled and dynamically-scheduled platforms like Kubernetes. The Zero Trust security model, which...

#HPE #Scytale #SPIFFE #SPIRE

Hello! This is Andrew Harding from Scytale. If you are currently using Envoy to provide secure service-to-service communication, I’d like…

As service identities and CA certificates are rotated, updates are streamed back to Envoy, which can immediately apply them to new connections without interruption or downtime and without the private keys ever having to touch the disk. In other words, SPIRE’s rich methods of defining and attesting services can be used to target the Envoy process, define an identity for it, and provide it with X.509 certificates and trust information that Envoy can use for TLS communication.

#spire #spiffe #security #tls

Use an instance identity document to verify the attributes of your instance.

#aws #identity #security #spire #spiffe

SVID (SPIFFE Verifiable Identity Document) って何？

SVID (SPIFFE Verifiable Identity Document)

ここに記載されている情報は2017/11 時点ですでに古くなっている箇所がありますので、そのことに十分注意して読んでください。最新の情報は以下からアクセスしてください。

https://github.com/spiffe/spiffe/blob/master/standards/X509-SVID.md

注.) この情報は 2017/08/16 時点で GitHub で公開されている情報をもとにしています。原文はこちら

SPIFFE というセキュリティのフレームワークで使われるIDを定義したものであり、URI形式を使ってシステムを表す文字列の命名規則とその名前を主体として含む X.509証明書のエンコード方法について定義されています。

SPIFFE name format

SPIFFE に対応しているシステムは次の形式のURIによって名前が付けられる。

spiffe://trust-domain/path

上記の形式の名前を使ってサービスを特定したり、サービスオーナーを特定したりできる。

e.g.)

spiffe://staging.acme.com/payments/mysql

上記はacme.com で管理されている staging 環境の payments というまとまり(サービス)における mysql というサービスを表しており、

spiffe://k8s-west.acme.com/ns/staging-ns/sa/default

これは acme.com で管理される k8s-west という Kubernetes Cluster において、 staging-ns という Namespace の default という名前の ServiceAccount を表している。

SPIFFE issued X.509 certificate format

X.509 形式の証明書を発行する。それは以下の仕様に従って各フィールドが設定されている。

Field Description SAN uri:<spiffe_name> のフォーマットで表現される主体を含む AKID この証明書に署名したCA証明書の鍵情報。通常は中間証明書のCA証明書と一致する SKID 自身の証明書に含まれる鍵情報 Basic Constraint CA:false Extended Key Usage id-kp-serverAuth, id-kp-clientAuth Key Usage critical: keyAgreement, digitalSignature, keyEncipherment

e.g.)

Certificate: Data: Version: 3 (0x2) Serial Number: 60:98:1b:80:56:e9:d7:81:58:a0:45:58:02:10:aa:eb:a7:68:bb:56 Signature Algorithm: sha256WithRSAEncryption Issuer: O=acme.com, CN=acme.com Intermediate CA Validity Not Before: Mar 28 03:04:40 2017 GMT Not After : Apr 7 03:04:40 2017 GMT Subject: C=US, ST=CA, L=San Francisco, O=SPIFFE_CO, CN=Blog Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (2048 bit) Modulus (2048 bit): …….. Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Subject Alternative Name: URI:spiffe://dev.acme.com/foo-service, X509v3 Basic Constraints: critical CA:FALSE X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication X509v3 Subject Key Identifier: 64:56:52:B2:7B:DF:86:EC:AD:5D:89:86:5C:C8:FD:F7:4D:FE:B5:73 X509v3 Authority Key Identifier: keyid:4E:E5:C3:6D:4F:CB:1F:63:6C:B4:B7:72:EB:C6:CC:1D:D9:7F:1D:B0 Signature Algorithm: sha256WithRSAEncryption …….

#SPIFFE