Has anybody seen my keys? A key-hierarchy strategy for rack-level security
rfd.shared.oxide.computer
Has anybody seen my keys? A key-hierarchy strategy for rack-level security
1–5 of 5 posts
Re: Has anybody seen my keys? A key-hierarchy strategy for rack-level security
#2Oxide's trust quorum approach is also discussed on this podcast episode:
https://oxide-and-friends.transistor.fm/episodes/building-a-...
Re: Has anybody seen my keys? A key-hierarchy strategy for rack-level security
#3The bit I liked most is wrapping the old rack secret under a key derived from the new epoch so prepare can hand out shares without unlocking until commit
That tension between needing both secrets for ZFS rekey and only serving shares for the committed epoch is a real distributed systems headache and this is a clean way out of it
Re: Has anybody seen my keys? A key-hierarchy strategy for rack-level security
#4Is there any concern in this scheme with losing access to storage either temporarily or permanently due to losing access to key shares?
Re: Has anybody seen my keys? A key-hierarchy strategy for rack-level security
#5[flagged]