Major - P3 The key that the mongos and mongod will use to verify the clusterTime will be generated by the config server primary during transition to primary. It will be stored in the admin.system.keys with the following format:
{
_id: 'clusterTimeKey',
key: <20 byte key generated with secure PRNG in BinData>
}
The mongos or mongod would need to extract this key auth so it would be able to sign or verify the logicalTime metadata when it interacts with the client.
// POC for TimeProofService that will be owned by LogicalClock to sign and verify signatures.
namespace mongo {
class TimeProofService {
public:
using TimeProof = SHA1Hash;
TimeProof getProof(const LogicalTime& time) const {
auto timeStr = time.toString();
return hmacSha1(_key.c_str(), _key.size(), timeStr.c_str(), timeStr.length());
}
Status checkProof(const LogicalTime& time, const TimeProof& proof) const {
auto myProof = getProof(time);
if (myProof != proof) {
return Error;
}
return Status::OK();
}
private:
std::string _key;
};
}
Accessing and storing the key on the config server will be addressed in SERVER-28178