You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. The client extracts two pieces of information from the TDF:
38
-
1.[Key Access Object (KAO)](/spec/tdf/kao): This contains the wrapped key and the policy binding.
39
-
2. The [Policy](/spec/tdf/policy) from the manifest.
38
+
1.[Key Access Object (KAO)](/spec/schema/opentdf/key_access_object): This contains the wrapped key and the policy binding.
39
+
2. The [Policy](/spec/schema/opentdf/policy) from the manifest.
40
40
41
41
2. The client generates an ephemeral asymmetric key pair, used to wrap the KAO content (such as an AES encryption key that can access the TDF payload) from KAS.
42
42
@@ -84,7 +84,7 @@ At this point, the client is ready to make the rewrap request. The following is
84
84
85
85
NanoTDF leverages the same KAS Rewrap Endpoint but the request body differs slightly from a TDF Rewrap call.
86
86
87
-
1. The client extracts the NanoTDF [Header](/spec/nanotdf/manifest#331-header) and from that Header extracts the KAS URL.
87
+
1. The client extracts the NanoTDF [Header](/spec/schema/nanotdf#331-header) and from that Header extracts the KAS URL.
88
88
89
89
2. The client generates an ephemeral asymmetric key pair, used to wrap the shared secret originally generated on NanoTDF creation.
90
90
@@ -129,8 +129,8 @@ NanoTDF leverages the same KAS Rewrap Endpoint but the request body differs slig
129
129
}
130
130
```
131
131
132
-
5. KAS extracts the encrypted policy in the NanoTDF [Header](/spec/nanotdf/manifest#331-header) and verifies the policy binding.
132
+
1. KAS extracts the encrypted policy in the NanoTDF [Header](/spec/schema/nanotdf#331-header) and verifies the policy binding.
133
133
- If ECDSA Binding is enabled KAS will verify the use ECDSA to verify the signature otherwise it defaults to comparing the `GMAC`
134
134
135
-
6. If the policy is valid and untampered, KAS calls the [Authorization Service](./authorization) to confirm whether the entity is allowed access to the NanoTDF. If authorized, KAS generates a new shared key with the clients ephemeral public key and uses `AES-GCM` to encrypt the shared secret used to encrypt the NanoTDF payload.
135
+
2. If the policy is valid and untampered, KAS calls the [Authorization Service](./authorization) to confirm whether the entity is allowed access to the NanoTDF. If authorized, KAS generates a new shared key with the clients ephemeral public key and uses `AES-GCM` to encrypt the shared secret used to encrypt the NanoTDF payload.
Copy file name to clipboardExpand all lines: docs/introduction.mdx
+22-20Lines changed: 22 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
sidebar_position: 1
3
3
---
4
4
5
-
importReactfrom'react';
6
-
importCalloutfrom'@site/src/components/Callout';
7
-
importCardsfrom'@site/src/components/Cards';
5
+
importReactfrom"react";
6
+
importCalloutfrom"@site/src/components/Callout";
7
+
importCardsfrom"@site/src/components/Cards";
8
8
9
9
# Welcome to OpenTDF Docs
10
10
@@ -13,39 +13,39 @@ Find all the information you need to get started with OpenTDF.
13
13
<Callout
14
14
title="Quick Start"
15
15
callToAction={{
16
-
label: 'Learn more',
17
-
link: '/getting-started',
16
+
label: "Learn more",
17
+
link: "/getting-started",
18
18
}}
19
19
>
20
-
This guide will walk you through setting up a new OpenTDF platform locally and walk you through
21
-
some of the basic concepts within the OpenTDF platform.
20
+
This guide will walk you through setting up a new OpenTDF platform locally and
21
+
walk you through some of the basic concepts within the OpenTDF platform.
22
22
</Callout>
23
23
24
-
<Cards
24
+
<Cards
25
25
height={300}
26
26
columns={3}
27
27
items={[
28
28
{
29
-
name: 'TDF',
29
+
name: "TDF",
30
30
description: `
31
31
The Trust Data Format (TDF) is an open standard that enables the cryptographic binding ofattribute-based
32
32
access control (ABAC) policy to a data object so that the policy travels with the data.`,
33
-
url: '/category/base-tdf',
33
+
url: "/spec/schema/opentdf",
34
34
},
35
35
{
36
-
name: 'Policy',
36
+
name: "Policy",
37
37
description: `The OpenTDF Policy engine enables creation, enforcement, and subscription to policies. By
38
38
using attribute-based access control (ABAC) policies, the OpenTDF Policy engine can enforce flexible,
39
39
fine-grained access control based on entity entitlements.`,
40
-
url: '/components/policy',
40
+
url: "/components/policy",
41
41
},
42
42
{
43
-
name: 'Authorization',
43
+
name: "Authorization",
44
44
description: `The OpenTDF Authorization service enables policy driven, access based decisions using
45
45
attribute-based access control (ABAC) based on entity entitlements. These decisions are used to enforce
46
46
both data privacy and application security, ensuring consistent policy enforcement across all policy
47
47
enforcement points.`,
48
-
url: '/components/authorization',
48
+
url: "/components/authorization",
49
49
},
50
50
]}
51
51
/>
@@ -58,14 +58,16 @@ Find all the information you need to get started with OpenTDF.
58
58
columns={2}
59
59
items={[
60
60
{
61
-
name: 'SDK',
62
-
description: 'Learn about the Trust Data Format (TDF) and how it enables the cryptographic binding of attribute-based access control (ABAC) policy to a data object.',
63
-
url: '/category/sdk',
61
+
name: "SDK",
62
+
description:
63
+
"Learn about the Trust Data Format (TDF) and how it enables the cryptographic binding of attribute-based access control (ABAC) policy to a data object.",
64
+
url: "/category/sdk",
64
65
},
65
66
{
66
-
name: 'CLI',
67
-
description: 'Learn about the OpenTDF CLI tool (otdfctl) and how it can be used to manage the OpenTDF platform.',
68
-
url: '/components/cli',
67
+
name: "CLI",
68
+
description:
69
+
"Learn about the OpenTDF CLI tool (otdfctl) and how it can be used to manage the OpenTDF platform.",
Copy file name to clipboardExpand all lines: docs/spec/_category_.json
+3-3Lines changed: 3 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
"label": "Specification",
3
3
"position": 10,
4
4
"link": {
5
-
"type": "generated-index",
6
-
"description": "OpenTDF includes specifications for multiple variations of the Trusted Data Format (TDF) including the JSON encoded Base TDF data format and the NanoTDF binary file format. These specifications are intended to be used as a reference for developers who are implementing TDF support in their applications."
0 commit comments