3 ms·
Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page) I assume the ENVKEY is some sort of ID or part of OpenPGP d
by hdhzy 9y ago
Sound cool. Could you give a high level view on how does this exactly work? (I've skimmed the page)
I assume the ENVKEY is some sort of ID or part of OpenPGP decryption key. Where does the actual config come from? Is it stored in encrypted form in some kind of shared service?
- danenania 9y agoSure. EnvKey is essentially a thick convenience/signature verification/web of trust layer on top of OpenPGP. Every user and every ENVKEY (which gives access to either a local dev machine or a server) represents an OpenPGP keypair. As you add/edit config, an encrypted copy is created for each public key that has access to that environment. The config itself is stored encrypted in EnvKey's servers, and is also backed up to S3 (in a separate region) on every update. An ENVKEY is one part lookup id and one part OpenPGP passphrase. For example in this one: ENVKEY=QD8zrywsAccdUhLKSqAx-36MWK4hmY8sd9Siw QD8zrywsAccdUhLKSqAx is the lookup id, and 36MWK4hmY8sd9Siw is the passphrase. You can see what a raw server response looks like here: http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx http://env.envkey.com/v1/QD8zrywsAccdUhLKSqAx It contains the encrypted config, the ENVKEY's associated public key, a private key encrypted with a 16-char alphanumeric passphrase (the second portion of the ENVKEY), trusted public keys that were stored and signed by the private key when the ENVKEY was generated, the public key of the last user to update the associated config, and a chain of signed public keys that allows the client libraries to verify that updater's public key back to an initially trusted public key. For more nitty gritty details on encryption and security, you can read more here: https://security.envkey.com https://security.envkey.com
- hdhzy 9y agoExcellent summary. Thanks a lot!