lib/signer
lib/countersigner

The signer daemon

If non-existent, the signer daemons creates and initializes /keydb/signerkey with an owner name of '*'. That file can also be created with the createsignerkey command (see createsignerkey - command to create signer key on authentication server).

The signer daemon 'blinds' the certificate by the technique of XOR-ing it with a random bit mask, then sends the result to the requesting client. The client's user uses that information to establish identity with a human agent on the 'signer'. The signer daemon also saves the both the 'blinded' and 'unblinded' result in the input for the verify command (/keydb/signed/set-top-box-id).

The countersigner daemon

Files

/keydb/signerkey	Secret key of the 'signer' host.
/keydb/signed/set-top-box-id	Repository of 'blinded' and clear certificates.
/keydb/countersigned/set-top-box-id	Repository of 'unblinded' certificates.