blob: b4ae80a134d26e1b5d567c84366b922b4b8efaeb [file] [log] [blame]
SafeBag Format for Exported Credentials
=======================================
Sometimes it may be necessary to export an identity's credentials (i.e., private key and associated
certificate) from one machine and import them into another. This requires a secure container to
carry the sensitive information. For this purpose, we define the **SafeBag** format, which contains
an `NDN certificate <https://named-data.net/doc/NDN-packet-spec/0.3/certificate.html>`__ and the
corresponding private key in encrypted form. The private key is formatted as a DER-encoded
:rfc:`EncryptedPrivateKeyInfo <5208#section-6>` structure as described in PKCS #8.
The TLV encoding of ``SafeBag`` is defined as follows:
.. code-block:: abnf
SafeBag = SAFE-BAG-TYPE TLV-LENGTH
Certificate
EncryptedKey
EncryptedKey = ENCRYPTED-KEY-TYPE TLV-LENGTH
*OCTET ; PKCS #8 EncryptedPrivateKeyInfo
+---------------------------------------------+------------------+-----------------+
| Type | Assigned number | Assigned number |
| | (decimal) | (hexadecimal) |
+=============================================+==================+=================+
| SafeBag | 128 | 0x80 |
+---------------------------------------------+------------------+-----------------+
| EncryptedKey | 129 | 0x81 |
+---------------------------------------------+------------------+-----------------+