Linux Security Summit North America 2017

Keeping secrets is tough. It is hard enough when you have control over the full computing chain. But now we are expected to keep secrets while storing those secrets in cloud and SaaS infrastructures. At least we can trust the network providers, right? Of course, the answer is to encrypt the data. But then how do we know who should have access to the data and when?

This talk will look at the new strategies and cryptographic techniques implemented by the Clevis (client) and Tang (server) open source projects. Tang aims to be a replacement for key escrows, using simple algorithms to bind data to third party entities. Clevis is a decryption automation framework which permits sophisticated unlocking policies that go beyond password management.