Cordy/Cairn

Fork 0

Per-instance encryption domain separation; demote deployment single-key #31

New issue

Closed

opened 2026-07-25 17:44:04 +00:00 by Cordy · 2 comments

Cordy commented

2026-07-25 17:44:04 +00:00

Owner

Manuel dislikes the one-key-per-instance model (blast radius too large). Our deployment custody mode is exactly that.

Demote deployment custody to dev/fallback only (default stays keycloak-profile per-user).
Add a per-instance seed/nonce so identical plaintext never produces identical ciphertext across instances (domain separation).

Small change; closes the blast-radius objection to the fallback mode.

Manuel dislikes the one-key-per-instance model (blast radius too large). Our `deployment` custody mode is exactly that. - Demote `deployment` custody to **dev/fallback only** (default stays `keycloak-profile` per-user). - Add a **per-instance seed/nonce** so identical plaintext never produces identical ciphertext across instances (domain separation). Small change; closes the blast-radius objection to the fallback mode.

Cordy added this to the v0.4 — Real competitor (parity + hardening) milestone

2026-07-25 17:44:04 +00:00

Cordy referenced this issue

2026-08-03 19:02:24 +00:00

Credential-derived key custody — spike (local/LDAP only) #30

Cordy commented

2026-08-03 19:03:06 +00:00

Author

Owner

Decision — approved with amended scope (Manuel's review, relayed by Nikola 2026-07-31):

"Yes, but no demote single-key per deployment."

Un-gated, scope narrowed: per-instance encryption domain separation goes ahead; the second half of the original title — demoting the deployment single-key custody mode — is dropped. keyCustody: "deployment" remains a fully supported first-class option (it's also the natural mode for small instances and the fallback when no IdP profile custody exists). Title kept for history; treat this comment as the authoritative scope.

**Decision — approved with amended scope (Manuel's review, relayed by Nikola 2026-07-31):** > "Yes, but no demote single-key per deployment." **Un-gated, scope narrowed:** per-instance encryption **domain separation** goes ahead; the second half of the original title — demoting the `deployment` single-key custody mode — is dropped. `keyCustody: "deployment"` remains a fully supported first-class option (it's also the natural mode for small instances and the fallback when no IdP profile custody exists). Title kept for history; treat this comment as the authoritative scope.

Cordy referenced this issue from a commit

2026-08-04 10:23:04 +00:00

ci: inspect auth middleware + key custody wiring (#96 #29 #31)

Cordy referenced this issue from a commit

2026-08-04 10:28:00 +00:00

feat(encrypt): minimal bech32 encoder for derived age identities (#31)

Cordy referenced this issue from a commit

2026-08-04 10:28:31 +00:00

feat(encrypt): per-instance domain separation for deployment custody (#31)

Cordy referenced this issue from a commit

2026-08-04 10:29:01 +00:00

feat(encrypt): StaticKeys gains derived per-instance identity (#31)

Cordy referenced this issue from a commit

2026-08-04 10:29:40 +00:00

test(encrypt): domain separation + bech32 oracle (#31)

Cordy referenced this issue from a commit

2026-08-04 10:38:13 +00:00

fix(test): exercise instance-B identities in separation check (#31)

forgejo-actions referenced this issue from a commit

2026-08-04 10:38:49 +00:00

feat: live group resolution (#96), OpenBao custody (#29), domain separation (#31)

Cordy referenced this issue

2026-08-04 10:40:41 +00:00

Live group resolution (#96), OpenBao custody (#29), domain separation (#31) #99

Cordy referenced this issue from a commit

2026-08-04 10:42:51 +00:00

Merge pull request 'Live group resolution (#96), OpenBao custody (#29), domain separation (#31)' (#99) from feat/custody-live-groups into main

forgejo-actions referenced this issue from a commit

2026-08-04 10:44:02 +00:00

docs: changelog for v0.3.28 (#96 #29 #31)

Cordy commented

2026-08-04 10:48:14 +00:00

Author

Owner

Shipped in v0.3.28 (PR #99), honoring the review verdict: deployment custody stays a full peer — not demoted. Only the domain-separation half was built.

New storage.encryption.instanceSeed (or CAIRN_ENC_INSTANCE_SEED): with a seed set, deployment custody derives a per-instance identity via HKDF-SHA256(deploymentIdentity, seed) (stdlib crypto/hkdf; the derived scalar is rendered with a minimal bech32 encoder validated against age's own parser as test oracle). New content encrypts to the derived identity + recovery. Test matrix proves: same master + different seeds → mutually unreadable; the bare master no longer decrypts separated content (the exact blast-radius objection); recovery always works; pre-separation data still decrypts (master retained on the decrypt side).

Operational note: the seed belongs in the config secret next to the master identity — it's a separator, not a second secret, and deriving from ephemeral /data state would silently orphan data on pod restart. Unseeded deployments behave exactly as before.

Shipped in **v0.3.28** (PR #99), honoring the review verdict: **deployment custody stays a full peer — not demoted**. Only the domain-separation half was built. New `storage.encryption.instanceSeed` (or `CAIRN_ENC_INSTANCE_SEED`): with a seed set, deployment custody derives a per-instance identity via HKDF-SHA256(deploymentIdentity, seed) (stdlib `crypto/hkdf`; the derived scalar is rendered with a minimal bech32 encoder validated against age's own parser as test oracle). New content encrypts to the derived identity + recovery. Test matrix proves: same master + different seeds → mutually unreadable; the **bare master no longer decrypts separated content** (the exact blast-radius objection); recovery always works; pre-separation data still decrypts (master retained on the decrypt side). Operational note: the seed belongs in the config secret next to the master identity — it's a separator, not a second secret, and deriving from ephemeral `/data` state would silently orphan data on pod restart. Unseeded deployments behave exactly as before.

Cordy closed this issue

2026-08-04 10:48:21 +00:00

Cordy referenced this issue

2026-08-04 11:30:24 +00:00

Post-quantum encryption: hybrid ML-KEM-768 identities with upgrade-on-touch (#28) #107

Cordy referenced this issue

2026-08-04 11:38:05 +00:00

Post-quantum (Hybrid ML-KEM-768) identity option #28

Cordy referenced this issue

2026-08-04 12:06:50 +00:00

Domain separation (instanceSeed) for post-quantum deployment identities #108

Cordy referenced this issue