Macaroons (computer science)

Short description: Credentials for authorization in computer science

In computer security, macaroons are authorization credentials that support decentralized delegation between principals.[1]

Macaroons are used in a variety of systems, including the Ubuntu Snappy package manager,[2] the HyperDex data store,[3][4] the Matrix communication protocol, and the Python Package Index.[5]

## Contents

* 1 Claims
* 2 Related technologies
* 3 Invalidation
* 4 See also
* 5 References

## Claims

A macaroon is composed of series of "caveats", for example:

* may upload files to /user/A/ (issued by server)
* only to /user/A/album/123 (derived by A)
* only GIFs, up to 1MB (derived by B)
* until noon today (derived by C)

The macaroon model doesn't specify the language for these caveats; The original paper proposes a model of subjects and rights, but the details are left to individual implementations.

## Related technologies

Macaroons are similar to some other technologies.

Compared to JSON Web Token (JWT):

* Holder of macaroon can issue a sub-macaroon with smaller power, while JWT is fixed
* Macaroon is notably longer than JWT
* Macaroon is equivalent to signed JWT, but does not offer equivalent to encrypted JWT

Compared to Certificates

* Macaroons are based on a symmetric model, while certificates on asymmetric
* Macaroons are computationally cheaper and require simpler cryptographic primitives
* Using a macaroon (sent to a server) can disclose some private information held by the macaroon holder, meaning that server must be trusted; Using a certificate means signing a payload using a private key, which is not sent to the server, thus communication with untrusted servers is less risky.

## Invalidation

Implementations need to decide whether the entire macaroon tree is invalidated at once from its root, the server secret key; or if intermediate macaroons are to be blacklisted, comparable to time-bound JWT's.

## See also

* Authorization
* HTTP cookie
* OAuth
* OpenID
* Simple public-key infrastructure

## References

1. ↑ Birgisson, Arnar; Politz, Joe Gibbs; Erlingsson, Úlfar; Taly, Ankur; Vrable, Michael; Lentczner, Mark (2014). "Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud" (in en). Proceedings 2014 Network and Distributed System Security Symposium (San Diego, CA: Internet Society). doi:10.14722/ndss.2014.23212. ISBN 9781891562358. https://www.ndss-symposium.org/ndss2014/programme/macaroons-cookies-contextual-caveats-decentralized-authorization-cloud/.
2. ↑ Nestor, Marius (16 April 2016). "Canonical Announces Snappy 2.0 Ahead of the Ubuntu Core 16.04 LTS Release". http://news.softpedia.com/news/canonical-announces-snappy-2-0-ahead-of-the-snappy-ubuntu-core-16-04-lts-release-503055.shtml.
3. ↑ "Time for Better Security for NoSQL". http://hackingdistributed.com/2014/11/23/macaroons-in-hyperdex/.
4. ↑ "My First Macaroon: A New Way to do Authorization". http://hackingdistributed.com/2014/05/21/my-first-macaroon/.
5. ↑ "A new package index for Python [LWN.net"]. https://lwn.net/Articles/751458/.

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Macaroons (computer science). Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Macaroons_(computer_science)&oldid=283235"