Kyle Isom
64d921827e
Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs stored in a new barrier_keys table, rather than encrypting all barrier entries directly. A v2 ciphertext format (0x02) embeds the key ID so the barrier can resolve which DEK to use on decryption. v1 ciphertext remains supported for backward compatibility. Key changes: - crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs - barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys) - seal: RotateMEK re-wraps DEKs without re-encrypting data - engine: Mount auto-creates per-engine DEK - REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate - proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate - db: migration v2 adds barrier_keys table Also includes: security audit report, CSRF protection, engine design specs (sshca, transit, user), path-bound AAD migration tool, policy engine enhancements, and ARCHITECTURE.md updates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
24 lines
841 B
HTML
24 lines
841 B
HTML
{{define "title"}} - Unseal{{end}}
|
|
{{define "container-class"}}auth-container{{end}}
|
|
{{define "content"}}
|
|
<div class="auth-header">
|
|
<div class="brand">Metacrypt</div>
|
|
<div class="tagline">Cryptographic Services</div>
|
|
</div>
|
|
<div class="card">
|
|
<div class="card-title">Unseal</div>
|
|
<p>The service is sealed. Enter the seal password to restore access.</p>
|
|
{{if .Error}}<div class="error">{{.Error}}</div>{{end}}
|
|
<form method="POST" action="/unseal">
|
|
{{csrfField}}
|
|
<div class="form-group">
|
|
<label for="password">Seal Password</label>
|
|
<input type="password" id="password" name="password" required autofocus autocomplete="current-password">
|
|
</div>
|
|
<div class="form-actions">
|
|
<button type="submit">Unseal</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
{{end}}
|