Retrieve the public key from cert and do a md5
openssl x509 -in server.crt -pubkey -noout | openssl md5
Retrieve the public key from private key and do a md5
openssl pkey -pubout -in server.key | openssl md5
If the outputs from two commands match, then the certificate must be created from the private key.
Function to listen to chaincode event
How to make zero-knowledge proofs non-interactive?
With earlier zero-knowledge verification systems there was one big problem. For it to work, the prover and the verifier had to be online at the same time. In other words, the process was “interactive”. This made the entire system inefficient and almost impossible to scale up. The verifiers couldn’t possibly be online at the same time as provers all the time? There needed to be a system to make this more efficient.
In 1986, Fiat and Shamir invented the Fiat-Shamir heuristic and successfully changed the interactive zero-knowledge proof to non-interactive zero knowledge proof. This helped the entire protocol work without any interaction. The procedure behind it is very simple.
So, to give you an example, this is how zero knowledge proofs used to work before Fiat and Shamir. Let’s prove this using simple discrete logarithms.
Now while the above interaction is zero-knowledge, the problem with this is that Anna and Carl need to be online and exchanging values for it to work.
How can Anna prove to Carl that she has knowledge of something without Carl being online? She can do so by using a simple cryptographic hash function, as Fiat and Shamir theorized.
Let’s look how the example above would work in a non-interactive way:
So, as you can see, zero knowledge proofs were made non interactive. And this was what laid the foundations for Zk-Snarks.
The above content is taken from this link https://blockgeeks.com/guides/zcash/
################## Create root ca certificate
# Create a private key
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
-pkeyopt ec_param_enc:named_curve -out ca.key
# Extract the public key
openssl ec -in ca.key -pubout -out ca_public.key
# Create signing certificate in one step
# Create root ca certificate
openssl req -new -days 3650 -nodes -x509 -extensions v3_req -extensions v3_ca \
-subj "/C=US/ST=North Carolina/L=Raleigh/O=org0.example.com/CN=ca1.org0.example.com" \
-addext "keyUsage=critical,digitalSignature,keyEncipherment,keyCertSign,cRLSign" \
-addext "extendedKeyUsage=serverAuth,clientAuth" \
-addext "subjectAltName=IP.1:192.168.56.32" -key ca.key \
-out ca.crt
# Inspect the certificate
openssl x509 -noout -text -in ca.crt
################ Create User certificate
# Create private key for admin
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
-pkeyopt ec_param_enc:named_curve -out admin.key
# Extract public key for admin
openssl ec -in admin.key -pubout -out admin_public.key
# Create admin CSR
openssl req -new -key admin.key -extensions v3_req \
-subj "/C=US/ST=North Carolina/L=Raleigh/OU=admin/OU=client/CN=Admin@org0.example.com" \
-out admin.csr
# Verify CSR
openssl req -verify -text -noout -in admin.csr
# The content of v3.ext file
# keyUsage = critical,digitalSignature
# basicConstraints = critical,CA:FALSE
# authorityKeyIdentifier = keyid,issuer
# key usage can be other values as well
# keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
# Now sign the CSR with ca key and cert
openssl x509 -req -days 3560 -extfile v3.ext -in admin.csr -CA ca.crt -CAkey ca.key \
-CAcreateserial -sha256 -out admin.crt
# Verify certificate
openssl x509 -noout -text -in admin.crt
################ Create peer and orderer certificate
# Create private key for peer1
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
-pkeyopt ec_param_enc:named_curve -out peer1.key
# Extract public key for peer1
openssl ec -in peer1.key -pubout -out peer1_public.key
# Create peer1 CSR
openssl req -new -key peer1.key -extensions v3_req \
-subj "/C=US/ST=North Carolina/L=Raleigh/OU=peer/CN=peer1.org0.example.com" \
-out peer1.csr
# Verify CSR
openssl req -verify -text -noout -in peer1.csr
# The content of v3.ext file
# keyUsage = critical,digitalSignature
# basicConstraints = critical,CA:FALSE
# authorityKeyIdentifier = keyid,issuer
# key usage can be other values as well
# keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
# Now sign the CSR with ca key and cert
openssl x509 -req -days 3560 -extfile v3.ext -in peer1.csr -CA ca.crt -CAkey ca.key \
-CAcreateserial -sha256 -out peer1.crt
# Verify certificate
openssl x509 -noout -text -in peer1.crt
Windows 10 docker desktop made a lot of changes between wsl and wsl2 especially how the mount works. This change created a lot of issues. Here is the main difference:
WSL:
mount point starts at this:
on drive C: /host_mnt/c
on drive D: /host_mnt/d
WSL2:
mount point starts like this
on drive C: /run/desktop/mnt/host/c
on drive D: /run/desktop/mnt/host/d
Key usage extension
|
Description
|
|---|---|
Digital signature
|
Use when the public key is used with a digital
signature mechanism to support security services other than non-repudiation,
certificate signing, or CRL signing. A digital signature is often
used for entity authentication and data origin authentication with
integrity.
|
Non-repudiation
|
Use when the public key is used to verify digital
signatures used to provide a non-repudiation service. Non-repudiation
protects against the signing entity falsely denying some action (excluding
certificate or CRL signing).
|
Key encipherment
|
Use when a certificate will be used with a
protocol that encrypts keys. An example is S/MIME enveloping, where
a fast (symmetric) key is encrypted with the public key from the certificate.
SSL protocol also performs key encipherment.
|
Data encipherment
|
Use when the public key is used for encrypting
user data, other than cryptographic keys.
|
Key agreement
|
Use when the sender and receiver of the public
key need to derive the key without using encryption. This key can
then can be used to encrypt messages between the sender and receiver.
Key agreement is typically used with Diffie-Hellman ciphers.
|
Certificate signing
|
Use when the subject public key is used to
verify a signature on certificates. This extension can be used only
in CA certificates.
|
CRL signing
|
Use when the subject public key is to verify
a signature on revocation information, such as a CRL.
|
Encipher only
|
Use only when key agreement is also enabled.
This enables the public key to be used only for enciphering data while
performing key agreement.
|
Decipher only
|
Use only when key agreement is also enabled.
This enables the public key to be used only for deciphering data while
performing key agreement.
|
Extended key
|
Enable for these key usage extensions
|
|---|---|
TLS Web server authentication
|
Digital signature, key encipherment or key
agreement
|
TLS Web client authentication
|
Digital signature and/or key agreement
|
Sign (downloadable) executable code
|
Digital signature
|
Email protection
|
Digital signature, non-repudiation, and/or
key encipherment or key agreement
|
IPSEC End System (host or router)
|
Digital signature and/or key encipherment or
key agreement
|
IPSEC Tunnel
|
Digital signature and/or key encipherment or
key agreement
|
IPSEC User
|
Digital signature and/or key encipherment or
key agreement
|
Timestamping
|
Digital signature, non-repudiation.
|
tcp-ports)ssl-services)ssl-services annotation. With the ssl-services
annotation, the ALB terminates the external TLS
connection, then creates a new SSL connection between the
ALB and the app pod. Traffic is re-encrypted before it is sent to the
upstream pods.sysctl -e -w fs.file-max=6000000; sysctl -e -w fs.nr_open=10000000; sysctl -e -w net.core.rmem_max=16777216; sysctl -e -w net.core.wmem_max=16777216; sysctl -e -w net.core.rmem_default=12582912; sysctl -e -w net.core.wmem_default=12582912; sysctl -e -w net.core.optmem_max=25165824; sysctl -e -w net.core.netdev_max_backlog=262144; sysctl -e -w net.core.somaxconn=32768; sysctl -e -w net.core.rps_sock_flow_entries=32768; sysctl -e -w net.ipv4.ip_local_port_range="1025 65535"; sysctl -e -w net.ipv4.tcp_rmem="8192 262144 16777216"; sysctl -e -w net.ipv4.tcp_wmem="8192 262144 16777216"; sysctl -e -w net.ipv4.udp_rmem_min=16384; sysctl -e -w net.ipv4.udp_wmem_min=16384; sysctl -e -w net.ipv4.ip_no_pmtu_disc=0; sysctl -e -w net.ipv4.route.flush=1; sysctl -e -w net.ipv4.tcp_dsack=1; sysctl -e -w net.ipv4.tcp_sack=1; sysctl -e -w net.ipv4.tcp_fack=1; sysctl -e -w net.ipv4.tcp_max_tw_buckets=1440000; sysctl -e -w net.ipv4.tcp_tw_recycle=0; sysctl -e -w net.ipv4.tcp_tw_reuse=1; sysctl -e -w net.ipv4.tcp_frto=0; sysctl -e -w net.ipv4.tcp_syncookies=1; sysctl -e -w net.ipv4.tcp_max_syn_backlog=32768; sysctl -e -w net.ipv4.tcp_synack_retries=2; sysctl -e -w net.ipv4.tcp_syn_retries=3; sysctl -e -w net.ipv4.tcp_fin_timeout=5; sysctl -e -w net.ipv4.tcp_retries2=5; sysctl -e -w net.ipv4.tcp_no_metrics_save=1; sysctl -e -w net.ipv4.tcp_moderate_rcvbuf=1; sysctl -e -w net.ipv4.tcp_timestamps=1; sysctl -e -w net.ipv4.tcp_keepalive_time=300; sysctl -e -w net.ipv4.tcp_keepalive_intvl=30; sysctl -e -w net.ipv4.tcp_keepalive_probes=6; sysctl -e -w net.ipv4.tcp_slow_start_after_idle=0; sysctl -e -w net.ipv4.tcp_window_scaling=1; sysctl -e -w net.ipv4.tcp_low_latency=1; sysctl -e -w net.ipv4.tcp_max_orphans=262144; sysctl -e -w net.nf_conntrack_max=9145728; sysctl -e -w net.netfilter.nf_conntrack_max=9145728; sysctl -e -w net.netfilter.nf_conntrack_tcp_timeout_time_wait=10; sysctl -e -w net.netfilter.nf_conntrack_tcp_timeout_fin_wait=10; sysctl -e -w net.netfilter.nf_conntrack_tcp_timeout_close_wait=30; sysctl -e -w net.netfilter.nf_conntrack_tcp_loose=1; sysctl -e -w net.ipv4.tcp_rfc1337=1;
Use the following yaml file to create a load balancer service on k8s. This load
balancer service will be backed by the deployment which only consists replicate
set with 2 containers using nginx.
---
apiVersion: v1
kind: Service
metadata:
name: my-service8080
spec:
selector:
app: my-nginx
ports:
- port: 8080
targetPort: 80
type: LoadBalancer
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
selector:
matchLabels:
app: my-nginx
replicas: 2
template:
metadata:
labels:
app: my-nginx
spec:
containers:
- name: my-nginx
image: nginx
ports:
- containerPort: 80
kubectl get svc my-service8080
kubectl get svc my-service8080 -o yaml
curl -sL https://ibm.biz/idt-installer | bash ibmcloud plugin install kubernetes-service ibmcloud login -a cloud.ibm.com -r us-south --sso -u <id@us.ibm.com> -p <password> -g Default ibmcloud ks cluster config --cluster <cluster-id>Note:* To check what plugins are available for CLI, run the following command
ibmcloud plugin repo-plugins -r 'IBM Cloud'1. git remote add upstream https://github.com/hyperledger-cicd/cello.git 2. git fetch upstream 3. git reset --hard upstream/master 4. git checkout master 5. git merge upstream/master 6. git push --forceOnce this is done, your forked repo should be completely insynch with the upstream repo. the word upstream in this case is just a name for the upstream repo, it can be named any thing you like. If you are not using the word upstream, you will have to make sure that the following on commands using the correct upstream name.
api=("src/api-engine/"
"build_image/docker/common/api-engine")
dashboard=("src/dashboard/"
"build_image/docker/common/dashboard")
ansibleagent=("src/agent/ansible/"
"build_image/docker/agent/ansible")
cdir=$(pwd)
cd ~/hl/src/github.com/realcello
allchanges=$(git diff --name-only HEAD~15 HEAD~20)
cd $cdir
echo "$allchanges"
hasTopChanges=$(echo "$allchanges" | grep -v '/')
if [ ! -z "$hasTopChanges" ]; then
echo 'Has changes at the root, need to proceed'
exit 0
fi
comp=$1
compItems="${comp}[@]"
changesFound='False'
echo 'Items in '${comp}
for item in "${!compItems}"; do
echo " checking $item"
if echo "${allchanges}" | grep -q "$item"
then
changesFound='True'
fi
done
if [ "$changesFound" == 'True' ]; then
echo 'Need to proceed'
else
echo "##vso[task.complete result=Succeeded;]No changes found!"
fi
api=("src/api-engine/"
"build_image/docker/common/api-engine")
dashboard=("src/dashboard/"
"build_image/docker/common/dashboard")
ansibleagent=("src/agent/ansible/"
"build_image/docker/agent/ansible")
allcomps=("api" "dashboard" "ansibleagent")
declare -A OPS
cdir=$(pwd)
cd ~/hl/src/github.com/realcello
allchanges=$(git diff --name-only HEAD~1 HEAD~10)
cd $cdir
echo "$allchanges"
for value in ${allcomps[@]}; do
comps="${value}[@]"
echo 'Items in '${value}
for item in "${!comps}"; do
echo " checking $item"
if echo "${allchanges}" | grep -q "$item"
then
OPS["${value}"]='true'
fi
done
done
for item in "${allcomps[@]}"; do
echo "$item"="${OPS[$item]}"
done
sudo apt-get remove unattended-upgrades
sudo systemctl stop apt-daily.timer
sudo systemctl disable apt-daily.timer
sudo systemctl disable apt-daily.service
sudo systemctl daemon-reload