Repository navigation
Conversation
added 11 commits
October 23, 2026 23:20
A key path whose first segment is exactly apps needs three segments for a key and two for a prefix. The kind of a key follows from its path. App ids are validated and can be checked against a host name. Details: TC-1777
…m public GET under apps/ Deletable keys carry a sealed per-key seed opened only with the strict unseal. Create, block and unblock run under the network row lock and refuse deleted rows. Create reuses a deleted deletable row with a new seed and the next key version. The public GET answers one 404 for every path under apps/. A startup check refuses key rows under apps/ that are not deletable. Details: TC-1777
…ests for app keys Details: TC-1777
Details: TC-1777
… id cannot carry Details: TC-1777
Details: TC-1777
…rds its prefix cap Details: TC-1777
…d no empty port Details: TC-1777
…ation and containment Details: TC-1777
… lock waits and startup refusal Details: TC-1777
…lockfiles Details: TC-1777
Contributor
Author
|
APPROVE: see TC-1777 (reviewed exact head 4b1cc83) |
…e scheme rule Details: TC-1777
Contributor
Author
|
APPROVE: see TC-1777 (reviewed exact head 6a94e39) |
This was referenced Oct 25, 2026
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Named keys whose path starts with
apps/are deletable keys with a per-key random seed; every other path is a deterministic key. Served only while[global.encryption_network] named_keys_v1is on (default off).appsisapps/<app id>/<name>for a key andapps/<app id>/for a prefix;apps,apps/<app id>andapps/are refused in delegations and invocations. App ids match^[a-z0-9][a-z0-9._-]{0,63}$.{ keyPath, deletable }:deletablemust equal the kind the path implies (400key_path_invalidotherwise); unknown fields are refused.encryption_network_key.sealed_seed; secret = HKDF(ikm = HKDF-Extract(salt = seed, ikm = network secret), salt =tinycloud.encryption.named-key/v1, info =seeded\n+ key URN). Known-answer vectors for both kinds. Seeds open only with the strict unseal; a deletable row that is notdeletedand has no seed is a corrupt row.activeorblockedand answer 403key_deletedon adeletedrow.deleteddeletable row reuses it with a new seed andkeyVersion+ 1; a decrypt for anotherkeyVersionanswers 403key_deleted. Per-network and per-apps/<app id>/(100) caps count deleted rows until they are reused.apps/answers one 404key_not_found. The authenticated GET returnskindandstate.key.blockunderapps/<app id>needs the app id bound to the SIWE domain and a SIWE scheme that is absent orhttps(app_id_not_bound); UCAN roots are not checked.apps/that are not deletable; the error carries the query that lists them. No data is deleted.docs/encryption-named-keys.md.Details: TC-1777