Trust model and keys
The SENTRA root key, the encrypted licensing vault, and the keys derived from it.
The root key#
SENTRA has one root key (Ed25519). Its public half is built into every ATS, NTS, GUARD and VIEW. Its private half:
- is stored only inside the Licensing Authority's encrypted vault, from which it is never shown or exported again;
- is kept, in addition, as one offline recovery copy under SENTRA's physical control;
- is never placed on any customer system, build server or code repository.
The root key signs: stand-alone and GUARD licences, signing-authority certificates for VIEWs and GUARDs, and the certificate of the release key. A root-key rotation is prepared in advance: products are first updated to trust the new public key alongside the old one; only then does the new key start signing.
The vault#
| Layer | Mechanism |
|---|---|
| Master key | 256 random bits, created once, held only in memory while the vault is unsealed |
| Wrapping | AES-256-GCM under a key derived from the vault passphrase with scrypt (N = 2^17, r = 8, p = 1: about 128 MiB of memory per guess) |
| Records | Every record (users, customers, licences, keys, authorities, settings) encrypted with AES-256-GCM; the record's type and ID are bound in as associated data |
| Sub-keys | Derived with HKDF-SHA256: separate keys for records, the blind index, the audit trail and its MACs |
| Look-ups | An HMAC-SHA256 blind index: names and IDs are never stored readably, not even a customer's name |
| Sealing | After any restart the vault is sealed; nothing can be read or signed until an authorised person enters the passphrase |
Backups are copies of the encrypted files: useless without the passphrase. The passphrase is not stored anywhere on the server and cannot be recovered.
Derived keys#
| Key | Held by | Certified by | Signs |
|---|---|---|---|
| Root key | The vault (+ offline copy) | — | OTG1 licences, OTGA1 authority certificates, the release-key certificate |
| Authority key | A customer's VIEW or GUARD (generated there, never leaves it) | The root key, with limits | OTG2 licences for that customer's fleet |
| Release key | The vault | The root key (5-year certificate, limited to SENTRA's products) | Each product's release list |
A compromise of one VIEW's authority key lets an attacker issue keys only within that authority's limits (products, modules, counts, latest expiry), and only until the certificate ends. A compromise of the release key can be answered by rotating it: products trust the root, not the release key, so a new certified release key replaces it at once.