User:Martinlanghoff/Key Autonomy: Country PoV
Jump to navigation
Jump to search
Main options / variables
- Augment or Replace OLPC keys
- Delivery Chain Security
- Time-based activation + active kill
to do: Summarize the top level concerns
Simple Scenario: Delivery Chain Security
Preparations
- Generate country keys
- Setup an offline signing machine
- Load keys on signing machine
- Prepare and sign custom OS image
With each shipment:
- Load data from Quanta to signing machine
- Generate activation keys
On every OS update
- Sign OS / kernel / initrd / OFW images
Other:
- Setup a formal workflow for developer key requests
Advanced Scenario: Time-based Activation + Active Kill
Preparations
- Generate country keys
- Setup an offline signing machine
- Prepare and sign custom OS image
- Install an Activation Server
- Load keys on Activation Server
With each shipment:
- Load data from Quanta to Activation Server
- Generate activation keys (optional, may be used as a complement to XS-based activation)
On every OS update
- Sign OS / kernel / initrd / OFW images
Other:
- Setup a formal 'report XO as stolen' workflow, and mark the XOs as stolen on the Activation Server.
- Review devkey request on the Activation Server.
- Regularly update the delegations on the Activation Server.
What is?
What is: Signed OS images?
to do
What is: A signing server?
to do