TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Container Identity and Secret Management

1 post · Nov 2013 – Jul 2017

What this trail covers

Cloudflare has developed PAL (Permissive Action Link), a tool to securely distribute secrets to Dockerized production applications. PAL addresses the challenge of bootstrapping service identity in containerized environments by allowing encrypted secrets to be decrypted at runtime after the service's identity has been established. It supports PGP and Red October for encryption and leverages container labels and cgroups for authorization, enabling secure access control for secrets and facilitating secure multi-party operations.

All Cloudflare trails
  1. A container identity bootstrapping toolThis post introduces PAL (Permissive Action Link), a tool for securely distributing secrets to Dockerized production applications. PAL enables encrypted secrets to be decrypted at runtime after a service's identity is established, using PGP or Red October for encryption and leveraging container labels and cgroups for authorization. It addresses the 'chicken and egg' problem of bootstrapping service identity for secret management services.
  2. Red October: CloudFlare’s Open Source Implementation of the Two-Man RuleThis post introduces Red October, a cryptographically-secure implementation of the two-person rule for protecting sensitive data. It is a software-based encryption and decryption server built in Go. Red October encrypts payloads such that no single individual can decrypt them, tying encryption to the credentials of authorized users. Users can delegate their credentials to the server for a limited time. The server decrypts payloads when the appropriate number of users have delegated their credentials. It uses 128-bit AES, 2048-bit RSA, and scrypt. The server never stores account passwords, only salted hashes. Private keys are encrypted with a password-derived key using scrypt. Data is encrypted with a random AES key, then doubly encrypted for each pair of users, and key encryption keys are encrypted with RSA public keys. The server decrypts data by using RSA private keys to decrypt key encryption keys, then using those to decrypt doubly encrypted data keys, which then decrypt the data. The server does not have the ability to decrypt user keys without their password.