rite 0.4.0

Author, execute, and verify cryptographic key ceremonies (the `rite` CLI)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

version: "0.2"
name: "Test Root CA"

backends:
  openssl:
    provider: openssl

parameters:
  ceremony_date:
    type: date
    default: "2026-01-01"

materials:
  transport_pubkey:
    type: digital

output:
  root_ca_public_key:
    type: public_key
  root_ca_cert:
    type: certificate
  wrapped_root_ca_key:
    type: wrapped_key

roles:
  crypto_officer:
    name: "Crypto Officer"
    person: "Alice"
  witness__1:
    name: "Witness 1"
    person: "Bob"
  witness__2:
    name: "Witness 2"
    person: "Carol"

sections:
  keygen:
    name: "Key Generation"
    role: "${role.crypto_officer}"
    steps:
      generate_root_ca:
        action: generate_keypair
        backend: openssl
        with:
          algorithm: RSA-4096
          key_usage: [key_cert_sign, crl_sign]
        creates: root_ca_keypair
      export_public_key:
        action: export_public
        backend: openssl
        reads: "${artifact.root_ca_keypair}"
        creates: root_ca_public_key
      generate_root_csr:
        action: generate_csr
        backend: openssl
        reads:
          signing_key: "${artifact.root_ca_keypair}"
        with:
          subject: "CN=Test Root CA"
        creates: root_ca_csr
      issue_root_cert:
        action: issue_certificate
        backend: openssl
        reads:
          signing_key: "${artifact.root_ca_keypair}"
          csr: "${artifact.root_ca_csr}"
        with:
          profile: root_ca
          validity_days: 7300
        creates: root_ca_cert
      wrap_root_ca_key:
        action: wrap_key
        backend: openssl
        reads:
          key_to_wrap: "${artifact.root_ca_keypair}"
          wrapping_key: "${artifact.transport_pubkey}"
        with:
          algorithm: CMS-RSA-GCM
        creates: wrapped_root_ca_key

  attestation:
    name: "Attestation"
    steps:
      witness1_attest:
        action: attest
        role: "${role.witness__1}"
        with:
          statement: "I witnessed the ceremony."
      witness2_attest:
        action: attest
        role: "${role.witness__2}"
        with:
          statement: "I witnessed the ceremony."
      officer_attest:
        action: attest
        role: "${role.crypto_officer}"
        with:
          statement: "Ceremony complete."

after:
  archive:
    type: archive_materials
    role: crypto_officer
    items:
      - "Transcript"
    location: "Archive"