Protecting infrastructure secrets with Keywhiz from Square
corner.squareup.com
Protecting infrastructure secrets with Keywhiz from Square
1–10 of 10 posts
Re: Protecting infrastructure secrets with Keywhiz from Square
#2This is a good talk on (what I believe to be) this software:
https://www.slideshare.net/diogomonica/bletchley
Re: Protecting infrastructure secrets with Keywhiz from Square
#3This is a good talk on (what I believe to be) this software: https://www.slideshare.net/diogomonica/bletchley
Bletchley is actually a different piece of our infrastructure: it protects keys by storing them in hardware, whereas Keywhiz is aimed at distributing the secrets that apps really need (API tokens for 3rd party services, eg).
We presented Keywhiz at Baythreat in 2012: http://www.baythreat.org/2012/speakers.html I'm not sure if that was recorded, though.
Re: Protecting infrastructure secrets with Keywhiz from Square
#4I'd love to hear from some of the team who built this about differences between Keywhiz and Keyczar, which to my mind was the best-practice open-source cross-platform solution to date (i.e. if you're not relying on things like AWS Cloudformation config or Heroku config vars to "manage" secrets).
Obvious pieces to me appear to be (1) roles and auditability (2) end-user front-end (3) filesystem interface & associated ease of access for various services. But I'm not an expert!
Re: Protecting infrastructure secrets with Keywhiz from Square
#5I'd love to hear from some of the team who built this about differences between Keywhiz and Keyczar, which to my mind was the best-practice open-source cross-platform solution to date (i.e. if you're not relying on things like AWS Cloudformation config or Heroku config vars to "manage" secrets). Obvious pieces to me appear to be (1) roles and auditability (2) end-user front-end (3) filesystem interface & associated e…
Filesystem interface just by itself is a big difference.
Keywhiz lets you manage things like mysql or other configs which might contain things like username/passwords, passwords to unlock certificates, API keys, etc. If you don't have the resources/option to modify applications to use a specific API, the filesystem might be your only viable solution.
Re: Protecting infrastructure secrets with Keywhiz from Square
#6I'd love to hear from some of the team who built this about differences between Keywhiz and Keyczar, which to my mind was the best-practice open-source cross-platform solution to date (i.e. if you're not relying on things like AWS Cloudformation config or Heroku config vars to "manage" secrets). Obvious pieces to me appear to be (1) roles and auditability (2) end-user front-end (3) filesystem interface & associated e…
Keyczar is meant to solve a different problem. It’s meant to be a simple programmatic API for crypto operations, while being high-level and excluding unsafe options. NaCl (http://nacl.cr.yp.to/) has similar goals to Keyczar.
Keywhiz isn’t an interface for software to do crypto. Rather, it’s a system to manage the secrets/keys used for crypto and making them available to the services that need them. It doesn’t explicitly look at the content of secrets, unless a plugin is used.
Re: Protecting infrastructure secrets with Keywhiz from Square
#7I'd love to hear from some of the team who built this about differences between Keywhiz and Keyczar, which to my mind was the best-practice open-source cross-platform solution to date (i.e. if you're not relying on things like AWS Cloudformation config or Heroku config vars to "manage" secrets). Obvious pieces to me appear to be (1) roles and auditability (2) end-user front-end (3) filesystem interface & associated e…
Keyczar is meant to solve a different problem. It’s meant to be a simple programmatic API for crypto operations, while being high-level and excluding unsafe options. NaCl ( http://nacl.cr.yp.to/ ) has similar goals to Keyczar. Keywhiz isn’t an interface for software to do crypto. Rather, it’s a system to manage the secrets/keys used for crypto and making them available to the services that need them. It doesn’t expli…
Understood! I'd looked at Keyczar in the past as a component of a system to manage secrets/keys, but I see it's actually providing about 0% of what Keywhiz does.
Re: Protecting infrastructure secrets with Keywhiz from Square
#8This is a good talk on (what I believe to be) this software: https://www.slideshare.net/diogomonica/bletchley
Bletchley is actually a different piece of our infrastructure: it protects keys by storing them in hardware, whereas Keywhiz is aimed at distributing the secrets that apps really need (API tokens for 3rd party services, eg). We presented Keywhiz at Baythreat in 2012: http://www.baythreat.org/2012/speakers.html I'm not sure if that was recorded, though.
Cool, thanks. Are there any slides? I saw @diogomonica mention there have been several presentations, but I couldn't find any.
Re: Protecting infrastructure secrets with Keywhiz from Square
#9Earlier quoted context omitted.
Bletchley is actually a different piece of our infrastructure: it protects keys by storing them in hardware, whereas Keywhiz is aimed at distributing the secrets that apps really need (API tokens for 3rd party services, eg). We presented Keywhiz at Baythreat in 2012: http://www.baythreat.org/2012/speakers.html I'm not sure if that was recorded, though.
Cool, thanks. Are there any slides? I saw @diogomonica mention there have been several presentations, but I couldn't find any.
Back then we tried to upload the keynote to slideshare without success. I think the blog post pretty much covers the same material regarding Keywhiz but with more detail.
Re: Protecting infrastructure secrets with Keywhiz from Square
#10Hi,
First of all looks like an amazing project so thanks!
You mention key rotation but I think I might have misunderstood what you're talking about.
Let's say I have a symmetric key and I want to change it, in a CD environment there is a short period where you need to support two keys. How does KeyWhiz fit in there? If it doesn't I'd really like to understand what you meant