rfc: credible exit under encryption

[parkan]

📖 Preview

Summary

The MST bucket design's credible-exit test (#4) and the merged encryption design are currently incompatible: the exit CAR is FEE ciphertext and the only keys that open it are custodied by Hilt, with no release mechanism specified.

This RFC names the break, defines what "credible" must survive (cooperative exit vs vendor-failure-resistant "Tier 2"), and proposes: a key-manifest CAR export (per-part CEKs re-wrapped to a customer key, second root in the exit CAR -- O(parts) key work, blobs and CIDs untouched) as the standard cooperative exit; versioned tenant key release for full-tenant departure; and an explicit yes/no on the Tier 2 promise. Tier 2 is provisional throughout -- this RFC ships Tier 1 only, and an affirmed Tier 2 gets its own follow-up RFC.

Note: one open question is deliberately merge-blocking -- whether Tier 2 is promised (direction, not design). The document should merge with that answer recorded.

[hannahhoward]

This is really excellent.

I would go for implementing cooperative now, at least plan adverserial (Tier 2) even if we don't implement it.

@alanshaw + @parkan we should schedule this work. @parkan would you like to take a shot at implementation?

[parkan]

This is really excellent.

I would go for implementing cooperative now, at least plan adverserial (Tier 2) even if we don't implement it.

@alanshaw + @parkan we should schedule this work. @parkan would you like to take a shot at implementation?

yep I can take this up