Signy: Signed URLs for Small Devices(github.com)
github.com
Signy: Signed URLs for Small Devices
https://github.com/golioth/signy
2 comments
Interesting... do you have specific use-cases in mind? On my side, my fleet of IoT devices are communicating over MQTT with mTLS so I think it would be sufficient to "emulate" all the features of a signed URL, but I might be missing some use-cases?
Good question! We wrote a few blog[0] posts[1] about the motivation for signy and how it is used in practice. The primary use case is complex devices with multiple MCUs and multi-protocol connectivity (e.g. Wi-Fi, Cellular, Bluetooth, etc.). In this context, each MCU may have different security capabilities, and manufacturing / provisioning may be simplified by storing a single set of credentials (e.g. a private key) in a single secure storage location, then using that key to generate a temporary signed URL that can be handed to the less secure domain for a scoped operation, such as downloading an asset. There are also more niche use cases, such as allowing an end user to access a private resource by generating a signed URL and sending it to a phone via NFC.
[0]: https://blog.golioth.io/signed-urls-for-embedded-devices/ [1]: https://blog.golioth.io/signed-urls-on-esp32/
[0]: https://blog.golioth.io/signed-urls-for-embedded-devices/ [1]: https://blog.golioth.io/signed-urls-on-esp32/