5 ms·
The key rotation issue where there are extra complications around synchronizing multiple keyholders to use the updated credential is neatly solved by having two
by infogulch 7y ago
The key rotation issue where there are extra complications around synchronizing multiple keyholders to use the updated credential is neatly solved by having two keys, both valid, and rotating one at a time only after all nodes that need it have moved to the new one.
- Silhouette 7y agoSure, if the API you're dealing with supports that then it's easy. But if it doesn't, you have a non-trivial timing problem.
- infogulch 7y agoI would say that an API that requires authorization keys is incomplete if it doesn't provide the tools to manage them securely. How could a service even offer scalability and security if it doesn't support two keys with rotation? It's a "non-trivial problem" because consistent, available, distributed API key rotation is not just hard, it's impossible. (See: CAP) That doesn't solve your problem, but it means that you should take this complaint to whatever API service offering you are using.