Comments (6)
Hi @Hammatt the EdgeAgent and EdgeHub modules talk to iotedged (security daemon) to encrypt some data. We haven't exposed iotedged's encrypt api via the SDK so it would be some more work for you to call the encryption api. The example of this call is here: https://github.com/Azure/iotedge/blob/master/edge-util/src/Microsoft.Azure.Devices.Edge.Util/edged/WorkloadClient.cs.
from iotedge.
Thanks @dsajanice ! This looks like just what we're after!
It would be really nice if this was nicely exposed via the SDK, but for now I am happy to try to get it working using something similar to the WorkloadClient implementation.
I'm having some trouble working out what the uri should be to call against, would you be able to point me in the right direction?
from iotedge.
The URL is documented here: https://github.com/Azure/iotedge/blob/master/edgelet/workload/README.md
from iotedge.
Hi @dsajanice ,
I'm trying to decrypt data which was encrypted in a different module.
I used to get this error in the daemon:
Jul 30 04:30:24 gateway iotedged[9856]: 2018-07-30T04:30:24Z [INFO] - [work] - - - [2018-07-30 04:30:24.455841098 UTC] "POST /modules/clouduploadmodule/genid/{obfuscated}/decrypt?api-version=2018-06-28 HTTP/1.1" 500 Internal Server Error 163 "-" "-" pid(10978)
Jul 30 04:30:24 gateway iotedged[9856]: 2018-07-30T04:30:24Z [ERR!] - Internal server error: Sign failed
Jul 30 04:30:24 gateway iotedged[9856]: caused by: A error occurred retrieving a key from the key store.
Jul 30 04:30:24 gateway iotedged[9856]: caused by: HSM failure
Jul 30 04:30:24 gateway iotedged[9856]: caused by: HSM API failure occurred: 417
But now I'm passing the identity and genid in with the module because I see that they're added as aad during the encryption, so now i'm getting this error:
Error: HTTP Response:
{"message":"Module not found"}
Microsoft.Azure.Devices.Edge.Util.Edged.GeneratedCode.IoTEdgedException`1[Microsoft.Azure.Devices.Edge.Util.Edged.GeneratedCode.ErrorResponse]: Not Found
at Microsoft.Azure.Devices.Edge.Util.Edged.GeneratedCode.HttpWorkloadClient.DecryptAsync(String api_version, String name, String genid, DecryptRequest payload, CancellationToken cancellationToken)
at IoTEdgeModuleCommon.EdgeCrypto.CryptoHandlers.SecureDaemonCryptoHandler.Decrypt(Byte[] inBytesToDecrypt, Byte[] inInitializationVector)
29-07-2018 23:12:54.13 Error: Exception event logged. gatewayId: SupermicroDev. module: clouduploadmodule. type: Microsoft.Azure.Devices.Edge.Util.Edged.GeneratedCode.IoTEdgedException`1[Microsoft.Azure.Devices.Edge.Util.Edged.GeneratedCode.ErrorResponse].
which correlates to this error in the daemon:
Jul 30 04:21:30gateway iotedged[8032]: 2018-07-30T04:21:30Z [INFO] - Request not authorized - expected caller pid: 8382, actual caller pid: 8494
Jul 30 04:21:30 gateway iotedged[8032]: 2018-07-30T04:21:30Z [INFO] - [work] - - - [2018-07-30 04:21:30.813348183 UTC] "POST /modules/servermodule/genid/{obfuscated}/decrypt?api-version=2018-06-28 HTTP/1.1" 404 Not Found
Do you know of a way to get around this and decrypt data which was encrypted in another module? It's working fantastic otherwise.
from iotedge.
@Hammatt @dsajanice closing issue as it seems to be stale, please re-open if necessary.
from iotedge.
To answer the question from before it was closed: No, you cannot decrypt data in one module that was encrypted by another module. That is intentional, since the API is meant to be used to persist secrets that no other module should be able to read.
from iotedge.
Related Issues (20)
- IoT Edge produces too much traffic with default configuration, it is not conducive for billable networks such as cellular. HOT 13
- Iotedge fails to make docker-proxy.sock after reboot (file exists) in Ubuntu Core HOT 15
- How to run aziot-edge in a docker container? HOT 10
- EdgeAgent does not restart crashed module if busy downloading new manifest 1.4.10 HOT 5
- Create a reusable Volume in Azure IOT Edge Module via Container Create Options HOT 2
- Can not ssh into a (running) VM with Ubuntu Core 20 on my k3s cluster HOT 1
- Reported twin does not reflect running container HOT 2
- Scarthgap support? HOT 1
- Best Practices/Guidance on upgrading a remote database module HOT 3
- edgeAgent hangs after a networking issue. HOT 2
- [Documentation] [Low priority] Add to the config.toml template and documentation a section for logging HOT 2
- "Did not receive ack for message / System.TimeoutException: Message completion response not received" errors after environment upgrade HOT 3
- Iot edge not starting on debian bullseye HOT 2
- IoT Edge child node unable to connect to IoT Edge transparent gateway HOT 3
- User module unable to connect to Hub with 'Communication_error' HOT 1
- EdgeHub fails to parse valid D2C creation time UTC string
- Disable Edge CA renewal did not work
- Is it possible to manually renew the Edge CA certificates? HOT 3
- Manual IoT Edge CA certificate renewal error HOT 8
- Runtime: Metrics collector cannot be added to garbage collection list HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from iotedge.