Kyle Isom
64d921827e
Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs stored in a new barrier_keys table, rather than encrypting all barrier entries directly. A v2 ciphertext format (0x02) embeds the key ID so the barrier can resolve which DEK to use on decryption. v1 ciphertext remains supported for backward compatibility. Key changes: - crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs - barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys) - seal: RotateMEK re-wraps DEKs without re-encrypting data - engine: Mount auto-creates per-engine DEK - REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate - proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate - db: migration v2 adds barrier_keys table Also includes: security audit report, CSRF protection, engine design specs (sshca, transit, user), path-bound AAD migration tool, policy engine enhancements, and ARCHITECTURE.md updates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
32 lines
1.3 KiB
HTML
32 lines
1.3 KiB
HTML
{{define "title"}} - Login{{end}}
|
|
{{define "container-class"}}auth-container{{end}}
|
|
{{define "content"}}
|
|
<div class="auth-header">
|
|
<div class="brand">Metacrypt</div>
|
|
<div class="tagline">Cryptographic Services</div>
|
|
</div>
|
|
<div class="card">
|
|
<div class="card-title">Sign In</div>
|
|
<p>Authenticate with your MCIAS credentials.</p>
|
|
{{if .Error}}<div class="error">{{.Error}}</div>{{end}}
|
|
<form method="POST" action="/login">
|
|
{{csrfField}}
|
|
<div class="form-group">
|
|
<label for="username">Username</label>
|
|
<input type="text" id="username" name="username" required autofocus autocomplete="username">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="password">Password</label>
|
|
<input type="password" id="password" name="password" required autocomplete="current-password">
|
|
</div>
|
|
<div class="form-group">
|
|
<label for="totp_code">TOTP Code <small style="text-transform:none;letter-spacing:0;">(if enabled)</small></label>
|
|
<input type="text" id="totp_code" name="totp_code" autocomplete="one-time-code" inputmode="numeric">
|
|
</div>
|
|
<div class="form-actions">
|
|
<button type="submit">Login</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
{{end}}
|