Security
Know who holds every key.
In the design, a holder makes its own key and Connect receives a signing request, a public key, or nothing. On this showcase Raidiam's tools made the private halves and keep copies. The figure shows both, model by model, and what a stolen key would reach.
Who holds each private half
Raidiam Connect
The Raidiam side. Operated by Raidiam on this tenant.
Keys Raidiam holds
-
Private halfAnchor and authority signing keys
Sign the anchors' and authorities' statements and trust marks.
- Holds the private half
- Raidiam, in a key management service Deployment evidence
- Replaced by
- Raidiam. For the anchor key, each consumer adds the new key to its pin.
If it is stolen
It can sign for both trust domains. A separate key for each domain is Not observed on this tenant
-
Private halfHosted entity signing key
Signs the entity configuration of each entity Connect hosts.
- Holds the private half
- Raidiam Deployment evidence
- Replaced by
- Raidiam, the holder
If it is stolen
It signs as every hosted entity, and as entities that hold no key of their own. Vouching only a subject's own keys is Not observed on this tenant
The hosted entity's authentication key takes the certified path: a signing request crossed, and the catalogue holds the private half. Deployment evidence
-
Raidiam Connect Public half
Issues an X.509 certificate
A signing request
Custody model
Certified key
10 entities on this estate
Private half
- In the design
- The holder. Connect receives only its signing request.
- On this showcase
- Raidiam's setup tool made every key and keeps a copy. The deploy tool puts each one into its holder's service. Deployment evidence
- Replaced by
- The holder, with a new signing request
If it is stolen
It signs as its holder wherever a statement vouches the key.
-
Raidiam Connect Public half
Publishes the key as supplied. Issues nothing.
The public key
Custody model
Supplied public key
8 entities on this estate
Private half
- In the design
- The holder. Connect receives only the public key.
- On this showcase
- Raidiam's tools hold a copy of every private half, and its deploy tool made most of them. Deployment evidence
- Replaced by
- The holder, with a new public key
If it is stolen
It signs as its holder wherever a statement vouches the key.
-
Raidiam Connect
Publishes a statement about the party's root. Holds nothing for this key.
Nothing crosses
Custody model
Vouched by its own root
3 agents on this estate
Private half
- In the design
- The party. Its own root vouches the key, and Connect receives nothing.
- On this showcase
- Raidiam's tools hold a copy of every private half. Deployment evidence
- Replaced by
- The party, in its root's statement
If it is stolen
It signs as that agent wherever the party's root vouches the key.
What this means for your estate
-
Three custody models
Certified, supplied, or vouched by the party's own root.
-
Your PKI, or a supplied key
Connect certifies your request, or publishes the key you register.
-
Signers in a key service
The anchor and authority signers are keys in a key management service Raidiam operates.
-
If Connect is unreachable
A platform decides on answers it already holds, until the window it set expires. An unresolved agent waits.
Which of your signing keys would stay in a boundary you operate, and which would a tenant hold?
Ninety minutes, on the shape of your estate: which systems resolve first, which anchor each pins, and which key each party holds.