Repository navigation
docs(ops): add DID domain and key custody notes - #542
Merged
Merged
Conversation
LKSNDRTMLKV
added
documentation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two additions to the production runbook, both stating what the node does today and nothing it does not.
The DID domain is a trust root. A passport verifies against the operator's
did:webdocument, fetched over HTTPS from the operator's domain, and the resolver caches it for five minutes. Whoever controls the domain's DNS or TLS endpoint controls which keys verify. The node does not detect a changed document. The section lists the operator-side controls (registrar lock and two-factor sign-in, DNSSEC, CAA records, recording the key thumbprints after each rotation and comparing on a schedule).Key custody. What protects the signing key while the node runs: an AES-256-GCM key store with an Argon2id-derived key, the passphrase read only from the
KEY_STORE_PASSPHRASEenvironment variable, the decrypted key held in process memory, and no hardware-backed or remote-signer option. So anyone who can read the node's environment holds the passphrase; the section says to keep.envat mode0600, out of version control and out of backups that leave the host.Checked against the code
DID_DOC_CACHE_TTL(300 s) indpp-resolver/src/infra/did.rs.dpp-cryptokeystore (AES-256-GCM, Argon2id); passphrase read from the environment in the identity and node configs.pkcs11, HSM or KMS signer anywhere in the crates.Not done
No
KEY_STORE_PASSPHRASE_FILEvariant exists, so the runbook does not recommend delivering the passphrase by secret file. That would be a code change and its own PR.Gates
Docs only. Run locally:
debug-check,no-rsa-private-key,vocabulary-check,subjects-check,mod-rs-check,harness-check,outbound-check,spec-version-check,cargo fmt --check: all green. Not run locally: clippy, tests and the audit, since the diff touches no code; CI runs the full gate.