Documentation
¶
Overview ¶
Package mpcseal is cloud's client-side-CEK sealing client for the SEPARATE MPC node ring (ghcr.io/luxfi/mpc). It is the minimal inlined subset of the former github.com/hanzoai/kms/sdk/go client that clients/fleet and clients/provisioning use to seal per-org secrets (BYO kubeconfigs, provisioned-resource passwords) onto the MPC nodes so the nodes only ever store ciphertext.
WHY INLINED (HIP-0106 alignment). cloud embeds the canonical luxfi/kms SecretStore in-process (clients/kms — the deps.KMS / types.KMSClient), and MPC stays its own separate nodes on luxfi/mpc. Dropping that external dependency leaves cloud depending only on luxfi/kms (embedded) + hanzoai/iam (embedded). This package reproduces the SDK's wire protocol and key schedule VERBATIM, so the on-node ciphertext format is byte-for-byte unchanged — a pure dependency move, not a behavior change.
Zero-knowledge model: all encryption/decryption happens client-side with a Customer Encryption Key (CEK) derived from an admin passphrase; the CEK never leaves this process, and the MPC nodes only ever store encrypted blobs.
Passphrase -> Argon2id -> Master Key -> HKDF -> CEK (AES-256-GCM)
FOLLOW-UP (a separate, TESTED change — not this dependency move): fold fleet/provisioning sealing into cloud's embedded deps.KMS once types.KMSClient gains a Delete verb and the swap is verified against the live MPC ring, so there is exactly one KMS surface.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Client ¶
type Client struct {
// contains filtered or unexported fields
}
Client connects to the MPC node ring and provides zero-knowledge secret management. All secret data is encrypted client-side with the CEK; the MPC nodes only store encrypted blobs. Goroutine-safe.
The zero value is not usable; construct with NewClient.
func NewClient ¶
NewClient creates a client. It is initially locked; call Unlock before any Set/Get/Delete.
func (*Client) Delete ¶
Delete removes a secret from the MPC nodes. Succeeds when at least threshold nodes acknowledge.
func (*Client) Get ¶
Get retrieves an encrypted blob from the MPC nodes and decrypts it client-side with the CEK.
type Config ¶
type Config struct {
// Nodes is the list of MPC node addresses
// (e.g. ["https://kms-mpc-0:9999", "https://kms-mpc-1:9999"]).
Nodes []string
// OrgSlug is the organization identifier; it is the AES-GCM AAD and the
// path scope, so it binds every ciphertext to exactly one tenant.
OrgSlug string
// Threshold is the minimum number of nodes required for an operation (t-of-n).
Threshold int
// HTTPClient is an optional custom client. nil ⇒ a default 30s-timeout client.
HTTPClient *http.Client
}
Config configures a client. Nodes/OrgSlug/Threshold are required; HTTPClient is optional (a 30-second-timeout client is used when nil).
Source Files