Reduce skew in local sealing #7470
Replies: 2 comments 1 reply
-
|
Some analysis of our current ledger entry management later:
This means that unless we rev up the ledger format, I don't see any backwards compatible way to store the sealed secrets within the tx context. |
Beta Was this translation helpful? Give feedback.
-
|
Cédric Fournet suggested an alternative which is very promising! To run through the chain of keys
In the ledger (node info) store the RecoveryKey and the SealedRecoveryKey ciphertext. The primary maintains a ledger secret wrapping key which is encrypted by the public RecoveryKey. A recovering node derives the SealingKey, decrypts the SealedRecoveryKey using SealingKey yielding PrivRecoveryKey which can then be used to decrypt the ledger wrapping key recover the ledger. This approach has the benefit of ensuring that no private information needs to be sent over the network or stored in the ledger. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
One issue with the current implementation of local sealing is that the sealed secrets are written in the commit hook for updated ledger secrets.
This ensured uniformity between the replicas and the primary, however if there is a delay between writing the ledger entry with a new secret, also subsequent chunks, and writing the sealed secret, then that is a period of vulnerability for the node where if it fails it will be unable to recover the ledger.
The optimal option would be to tie the sealed secrets directly to the ledger, with the obvious action being to store the sealing key alongside the node data, and the primary uses that to seal the secret into the ledger for that node.
However this would require an asymmetric key, and the key derivation on SNP gives us a symmetric key.
One possible option here is to store the sealed secret in the transaction header of the ledger secret rekey transaction, for just that node's on-disk copy.
This would then keep the sealed ledger secret directly in sync with the ledger, preventing skew from occurring.
Additionally this would make rollback work fully with the sealed secrets.
Beta Was this translation helpful? Give feedback.
All reactions