Skip to content

Master Key Encryption HLD - #2493

Draft
fredxia-nexthop wants to merge 2 commits into
sonic-net:masterfrom
nexthop-ai:fredxia-master-key-encryption
Draft

Master Key Encryption HLD#2493
fredxia-nexthop wants to merge 2 commits into
sonic-net:masterfrom
nexthop-ai:fredxia-master-key-encryption

Conversation

@fredxia-nexthop

Copy link
Copy Markdown

Fix issues based on review comments:

  • Remove the design of allowing multiple master encryption keys
  • Remove storing of historical keys. Replace with activate_key/candidate_key to store active and staging keys
  • Remove invocation of openssl. Replace with built-in random key generation in master-key-manager
  • Remove some implementation details
  • Add ZTP and gNMI integration in Future Work
  • Add explanation on why decryption is application-specific and at place of use, while encryption is automatic and transparent

@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run

@azure-pipelines

Copy link
Copy Markdown
No pipelines are associated with this pull request.

@fredxia-nexthop fredxia-nexthop changed the title Check in HLD from pubic fork, plus nhcli doc placeholder NOS-796: Master Key Encryption HLD Aug 11, 2026
Fix issues based on review comments:
- Remove the design of allowing multiple master encryption keys
- Remove storing of historical keys. Replace with activate_key/candidate_key to store active and staging keys
- Remove invocation of openssl. Replace with built-in random key generation in master-key-manager
- Remove some implementation details
- Add ZTP and gNMI integration in Future Work
- Add explanation on why decryption is application-specific and at place of use, while encryption is automatic and transparent

Signed-off-by: Fred Xia <fredxia@nexthop.ai>
@fredxia-nexthop
fredxia-nexthop force-pushed the fredxia-master-key-encryption branch from 3e31816 to 8b7bdc6 Compare August 11, 2026 18:47
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run

@azure-pipelines

Copy link
Copy Markdown
No pipelines are associated with this pull request.

@fredxia-nexthop
fredxia-nexthop marked this pull request as draft August 11, 2026 18:48
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run

@azure-pipelines

Copy link
Copy Markdown
No pipelines are associated with this pull request.

@fredxia-nexthop fredxia-nexthop changed the title NOS-796: Master Key Encryption HLD Master Key Encryption HLD Aug 11, 2026
@mssonicbld

Copy link
Copy Markdown
Collaborator

/azp run

@azure-pipelines

Copy link
Copy Markdown
No pipelines are associated with this pull request.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants