Repository navigation
docs: record that vendor keys and long-lived credentials cross the Go host - #1563
Draft
freshtonic wants to merge 1 commit into
Draft
freshtonic wants to merge 1 commit into
freshtonic wants to merge 1 commit into
Conversation
… host ADR-0011 said key material never crosses to the Go host, and that only short-lived credentials cross to the guest. Neither is true for a key vendor backend. The guest sends each vendor request through transport_send, and the host does the TLS. So the host and a WithTransport RoundTripper see the unwrapped vendor key in plaintext: a root key under derived data keys, a data key under wrapped data keys. With ZeroKMS a response alone is not usable, so the claim held there. The credential import carries what the Go source returns, so AWSCredentialsFromEnv can pass an IAM user's long-lived keys, and StaticKey's key crosses once. Keep the design and say so. Amend ADR-0011. Correct the Go package docs, KeyVendor, WithTransport, AWSCredentialsFromEnv, StaticKey, the transport.go comment and guest/src/host.rs. Add a review section to the decision log that records these findings and the work that no ticket asked for.
|
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Docs only. A review found that two security claims about the Go SDK were not true when a key vendor backend is used, and this PR records them honestly.
In the Go SDK, the encryption runs inside a WebAssembly guest. The Go program around it is the host, which sends the guest's HTTP requests. ZeroKMS responses are safe for the host to see, because a response alone gives no usable key. A key vendor backend (AWS KMS, Google Cloud KMS, Azure Key Vault, Vault Transit) is different. The host does the TLS, so the host, and any
WithTransportRoundTripper, see the unwrapped vendor key in plaintext. Also, the credentials that cross to the guest are not always short-lived.The design stays as it is. Keeping vendor keys from the host would need TLS inside the guest, which is not planned.
Changes
doc.go(Transport and auth, key vendor backends),KeyVendor,WithTransport(trust the RoundTripper with key material),AWSCredentialsFromEnv(long-lived IAM keys cross on each request; prefer a role),StaticKey(the key crosses once).transport.go: the comment said the response carries "wrapped key material". For a vendor it is an unwrapped key.guest/src/host.rs: says what the host sees, and what credentials cross.@cipherstash/authnapi exports, the Go client with no ZeroKMS, the rewrap fix, the extrastash keysetflags and variable names, Azure workload identity, and the rule that a local record name wins.Verification
go vet ./encryptandgofmt -l: clean.go docshows the newWithTransporttext.cargo fmt --check: clean.Related
Refs #1562. Review findings on the key vendor backend stack.