Repository navigation
docs: record that vendor keys and long-lived credentials cross the Go host - #1563
freshtonic wants to merge 2 commits into
Conversation
|
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true |
c9a9918 to
c686e38
Compare
… host ADR-0011 said key material never crosses to the Go host, and that only short-lived credentials cross to the guest. Neither is true for a key vendor backend. The guest sends each vendor request through transport_send, and the host does the TLS. So the host and a WithTransport RoundTripper see the unwrapped vendor key in plaintext: a root key under derived data keys, a data key under wrapped data keys. With ZeroKMS a response alone is not usable, so the claim held there. The credential import carries what the Go source returns, so AWSCredentialsFromEnv can pass an IAM user's long-lived keys, and StaticKey's key crosses once. Keep the design and say so. Amend ADR-0011. Correct the Go package docs, KeyVendor, WithTransport, AWSCredentialsFromEnv, StaticKey, the transport.go comment and guest/src/host.rs. Add a review section to the decision log that records these findings and the work that no ticket asked for.
4c88fcb to
ee8d9d6
Compare
c686e38 to
e67e9d7
Compare
|
Folded into #1521 (ADR-0011's amendment on what crosses the Go host) and #1532 (the Go docs). The plan is |
Summary
Docs only. A review found that two security claims about the Go SDK were not true when a key vendor backend is used, and this PR records them honestly.
In the Go SDK, the encryption runs inside a WebAssembly guest. The Go program around it is the host, which sends the guest's HTTP requests. ZeroKMS responses are safe for the host to see, because a response alone gives no usable key. A key vendor backend (AWS KMS, Google Cloud KMS, Azure Key Vault, Vault Transit) is different. The host does the TLS, so the host, and any
WithTransportRoundTripper, see the unwrapped vendor key in plaintext. Also, the credentials that cross to the guest are not always short-lived.The design stays as it is. Keeping vendor keys from the host would need TLS inside the guest, which is not planned.
Changes
doc.go(Transport and auth, key vendor backends),KeyVendor,WithTransport(trust the RoundTripper with key material),AWSCredentialsFromEnv(long-lived IAM keys cross on each request; prefer a role),StaticKey(the key crosses once).transport.go: the comment said the response carries "wrapped key material". For a vendor it is an unwrapped key.guest/src/host.rs: says what the host sees, and what credentials cross.@cipherstash/authnapi exports, the Go client with no ZeroKMS, the rewrap fix, the extrastash keysetflags and variable names, Azure workload identity, and the rule that a local record name wins.Verification
go vet ./encryptandgofmt -l: clean.go docshows the newWithTransporttext.cargo fmt --check: clean.Related
Refs #1562. Review findings on the key vendor backend stack.