You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We need some way to sync the current (and previous) encryption key.
Initially we can start out with a static key set in the configuration.
Using key expansion to be able to rotate periodically would be nice, but needs some thought around when to rotate them and if clocks are in sync between servers.
We can perhaps use some hash chain for this, if we can recognize which key name that was used when a request arrives. In that case we can precompute the n before/next, and let the hitch instance with the most advanced clock set the pace. The others will follow onto the next chain entry either when they see the rebalanced client, or by themselves when their clock gets there.
We get a rotation period in the configuration ("daily") without having to explicitly set up communication between hitches.
https://www.ietf.org/rfc/rfc5077.txt
Related:
The text was updated successfully, but these errors were encountered: