letsencrypt / letsencrypt/boulder
sa.UpdateRegistrationKey: take previous key as input to ensure atomicity
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 5.8k
- Forks
- 649
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 24
Description
Currently it is possible for an account to make two simultaneous key rollover requests, each updating the account from the same key but to two different keys. To prevent this, the SA should use a WHERE jwk = <previous key> statement, ensuring that whichever database update arrives second doesn't clobber the first. This means that the previous key will need to be provided by the WFE to the RA, and from there to the SA, via gRPC.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Trace the key rollover path from the WFE to the RA and then the SA, focusing on the gRPC boundaries mentioned in the issue. Identify the existing sa.UpdateRegistrationKey flow and its database update, then verify that the previous key is passed through each layer and that concurrent rollovers cannot overwrite one another.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, grpc
- Domain
- api, backend, distributed-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100