Documentation
¶
Overview ¶
Package policy holds the rotation, epoch and retirement policy of a purpose.
A policy is data, not behavior: it says how often to rotate and how long to wait, and the rotate and retire packages act on it. Every field has a default taken from the specification, so an application that configures nothing gets the documented behavior, and a purpose overrides only what it must.
Index ¶
Constants ¶
const ( // DefaultKEKInterval is how long a KEK version stays active before the // next is activated. DefaultKEKInterval = 365 * 24 * time.Hour // DefaultDEKMaxAge is how long a data key epoch is used for writes. DefaultDEKMaxAge = 90 * 24 * time.Hour // DefaultDEKMaxEncryptions is the most encryptions made under one data key. DefaultDEKMaxEncryptions = keyforge.DefaultEncryptionCap // DefaultRetirementDelay is how long a version waits between a request to // retire it and its retirement. DefaultRetirementDelay = 30 * 24 * time.Hour // DefaultRetainVersions is how many versions are never retired: the active // one and the most recent decrypt-only one, which is the rollback margin. DefaultRetainVersions = 2 )
Defaults, from the specification.
const MinRetirementDelayFactor = 10
MinRetirementDelayFactor is how many times longer than the client cache TTL a retirement delay must be. A client that cached the active KEK version keeps wrapping under it until its entry expires, so the delay has to be far longer than that window for no new data key to appear under a version that is already eligible for retirement.
Variables ¶
This section is empty.
Functions ¶
func ParseDuration ¶
ParseDuration parses a duration that may use days: "365d", "90d", "36h", "30d12h". It is time.ParseDuration with a leading day count.
Types ¶
type Policy ¶
type Policy struct {
// KEKInterval is how long a KEK version is active before rotation.
KEKInterval time.Duration
// DEKMaxAge is how long a data key epoch is current before a new epoch.
DEKMaxAge time.Duration
// DEKMaxEncryptions is the cap on encryptions per data key.
DEKMaxEncryptions uint64
// RetirementDelay is the wait between a request to retire a version and
// its retirement.
RetirementDelay time.Duration
// RetainVersions is the floor on how many versions are kept: the active
// version and the most recent decrypt-only ones up to this count are never
// retired, even when nothing references them. It is a floor on retention,
// never a trigger to delete.
RetainVersions int
// RequireBackup makes rotation wait until the keyring's backup has been
// acknowledged as current, so that restoring it cannot lose data wrapped
// under a version it lacks.
RequireBackup bool
}
Policy is the policy of one purpose. In a Set a zero field means "not specified here" and takes the value from the set's default.
func (Policy) MarshalJSON ¶
MarshalJSON writes durations as strings with a day suffix where they are whole days, for configuration files.
func (*Policy) UnmarshalJSON ¶
UnmarshalJSON reads durations written as strings. An unknown field is an error, so a misspelled setting is not silently ignored.
type Set ¶
type Set struct {
// Default applies to every purpose. Its zero fields take the package
// defaults.
Default Policy
// Purposes overrides the default for a purpose. A zero field inherits.
Purposes map[keyforge.Purpose]Policy
}
Set is the policy of a deployment: a default and per-purpose overrides.
func (Set) For ¶
For returns the resolved policy for a purpose. A purpose with no override gets the set's default.
func (Set) PurposeConfigs ¶
func (s Set) PurposeConfigs(selections map[keyforge.Purpose]algorithm.Selection) map[keyforge.Purpose]keyforge.PurposeConfig
PurposeConfigs builds the client's per-purpose configuration from the policy: each purpose's data key age and volume cap, with the algorithm selection the caller gives for it. A purpose with no selection uses the profile's defaults.
Source Files