Skip to content

rfc: regional security principles and key management deployment proposal #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hannahhoward wants to merge 2 commits into
base: main
Choose a base branch
from
Open

rfc: regional security principles and key management deployment proposal #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c7061d6
rfc: regional security principles and key management deployment proposal
hannahhoward Aug 7, 2026
9dec98b
rfc: amend encryption design region wrap to AES-256-GCM (context-bound)
hannahhoward Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion rfcs/2026-06-fil-one-encryption-design.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ Object DELETE destroys every part's row in Ingot's DB. Subsequent GET/HEAD retur
| ------------------------- | --------------------- | --------------------------- | --------------------------------------- | -------------------------------------------------------------------- |
| Blob CEK | AES-256 | Blob | — | Encrypts the blob contents. Constant across regions when replicated. |
| Region KEK | AES-256 | Region | Region secure storage[^secure-storage] | Wraps the Blob CEK for the read path. |
| Region-KEK(Blob-CEK) | A256KW Result | Region × Blob[^replication] | Region Ingot DB | Unwrapped by Ingot to serve read requests. |
| Region-KEK(Blob-CEK) | AES-256-GCM Result[^region-wrap-gcm] | Region × Blob[^replication] | Region Ingot DB | Unwrapped by Ingot to serve read requests. |
| Tenant KEK | X25519 | Tenant | Hilt DB (public key only) | Wraps the Blob CEK for region-independent recovery. |
| Tenant-KEK(Blob-CEK) | ECDH-ES+A256KW Result | Blob | FEE Header at start of blob, in Forge | Unwrapped by Hilt for region-independent recovery. |
| Hilt Root KEK | AES-256 | Hilt (i.e., exactly one) | Fil One secure storage[^secure-storage] | Seals the KEKs in the Hilt DB. |
Expand All @@ -134,6 +134,8 @@ Key types:

[^replication]: Replication is not a current concern, so "Region × Blob" is currently the same as "Blob".

[^region-wrap-gcm]: Amended 2026-08: the region wrap is AES-256-GCM performed inside the region's secrets manager, context-bound to (space, blob digest); it was originally specified as A256KW. The tenant wrap and Hilt wraps are unchanged. Rationale and deployment: [RFC: Regional security principles and key management deployment proposal](./2026-08-regional-security-and-key-management.md).

### The Region DB

This DB schema is loose and illustrative. It will need to merge with similar schemas currently being specified with other aspects of the system in mind. For instance, the actual table holding Objects will likely have several additional fields defined by other streams of work. The basic structure outlined here should mesh with those designs.
Expand Down
Loading
Loading