diff --git a/doc/Security.xml b/doc/Security.xml index cfd8c6535..447fdfcba 100644 --- a/doc/Security.xml +++ b/doc/Security.xml @@ -34,7 +34,7 @@ RELATING TO ANY USE OR DISTRIBUTION OF THIS DOCUMENT, WHETHER OR NOT (1) THE CORPORATION, MEMBERS OR THEIR AFFILIATES HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, OR (2) SUCH DAMAGES WERE REASONABLY FORESEEABLE, AND ARISING OUT OF OR RELATING TO ANY USE OR - DISTRIBUTION OF THIS DOCUMENT.  THE FOREGOING DISCLAIMER AND LIMITATION ON LIABILITY DO NOT + DISTRIBUTION OF THIS DOCUMENT. THE FOREGOING DISCLAIMER AND LIMITATION ON LIABILITY DO NOT APPLY TO, INVALIDATE, OR LIMIT REPRESENTATIONS AND WARRANTIES MADE BY THE MEMBERS AND THEIR RESPECTIVE AFFILIATES TO THE CORPORATION AND OTHER MEMBERS IN CERTAIN WRITTEN POLICIES OF THE CORPORATION. @@ -4379,12 +4379,27 @@ Media Signing
Overview - Signing of media that is generated by the device is described in the [Media Signing - Specification]. Media is signed using a private key that is provisioned during factory - production that is stored in a specially protected hardware component (e.g., a trusted - platform module). This private key is associated with a certificate that holds the public - key. In addition to the factory provisioned key one additional private key can be used to - sign media. + Media authenticity data in the form of signatures is generated by the device and + included in the media stream as described in the [Media Signing Specification]. Media is + typically signed using a certificate based on the private key provisioned in one of the + below listed approaches + + + Factory Provisioned Key + + Private key provisioned into the device by the manufacturer and that private + key is associated with a certificate that holds the public key. + + + + User Provisioned Key + + User can provision an additional private key and that private key is + associated with a certificate that holds the public key. + + + +
AddMediaSigningCertificateAssignment @@ -4402,8 +4417,8 @@ request - CertificationPathID - [tas:CertificationPathID] The ID of the - certification path to assign for media signing. + CertificationPathID - [tas:CertificationPathID] + The ID of the certification path to assign for media signing. @@ -4415,11 +4430,12 @@ faults - env:Sender - ter:InvalidArgVal - ter:CertificationPathID No + env:Sender - ter:InvalidArgVal - ter:CertificationPathID + No certification path is stored in the keystore under the given certification path ID. - env:Sender - ter:InvalidArgVal - ter:NoPrivateKey The key pair that - is associated with the leaf certificate in the certificate chain does not have an + env:Sender - ter:InvalidArgVal - ter:NoPrivateKey + The key pair that is associated with the leaf certificate in the certificate chain does not have an associated private key. @@ -4444,8 +4460,8 @@ request - CertificationPathID - [tas:CertificationPathID] The ID of the - certification path to remove. + CertificationPathID - [tas:CertificationPathID] + The ID of the certification path to remove. @@ -4492,8 +4508,12 @@ CertificationPathID - optional, max 2 [tas:CertificationPathID] List of certification path IDs assigned for media signing. At least - one certification path will be returned, the factory provisioned one. At most two - certification paths will be returned. + one certification path that includes the factory provisioned one shall be returned. + At most two certification paths will be returned. + As response structure is CertificationPathID, to retrieve the assigned media + signing certificates as expected from the interface name + GetAssignedMediaSigningCertificates, client needs to make an additional request of + GetCertificationPath with CertificationPathID as input. @@ -4510,7 +4530,6 @@
-
Autorization Server Configuration This chapter describes configuration of external authorization servers. For an overview @@ -5536,23 +5555,6 @@ MaximumNumberOfDot1XConfigurations shall be greater than zero. - - - MediaSigningSupported - - - If true, GetAssignedMediaSigningCertificates shall be supported. - - - - - UserMediaSigningKeySupported - - - If true, AddMediaSigningCertificateAssignment and - RemoveMediaSigningCertificateAssignment shall be supported. - - EllipticCurves @@ -5590,6 +5592,7 @@ Service specific data types The service specific data types are defined in security.wsdl.
+ Security Considerations diff --git a/wsdl/ver10/advancedsecurity/wsdl/advancedsecurity.wsdl b/wsdl/ver10/advancedsecurity/wsdl/advancedsecurity.wsdl index 163f9eb90..4652f2390 100644 --- a/wsdl/ver10/advancedsecurity/wsdl/advancedsecurity.wsdl +++ b/wsdl/ver10/advancedsecurity/wsdl/advancedsecurity.wsdl @@ -2473,7 +2473,9 @@ - The IDs of all certification paths that are assigned for media signing. + The IDs of all certification paths that are assigned for media signing. + As expected response structure is misleading, to retrieve the assigned media signing certificates as expected from interface name, + client needs to make an additional request of GetCertificationPath with CertificationPathID as input.