Managing Server Secrets at Scale with a Vaultless Password Manager
summary
Cloudflare describes using firmware flash to store a single 256‑byte master seed in UEFI variables and a deterministic KDF + DRBG pipeline to derive per-server SSH, disk‑encryption and CM bootstrap keys on boot. A small tool called go key generates the seed only after checking entropy, writes it to UEFI, and reproduces unique keys per server so configuration management holds only key usage strings; this enables fleet-wide rotation by changing one string.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:00Disclaimer
- 2:00Minimum Server Secrets
- 4:20Services
- 6:14Key Location
- 8:07Configuration Management
- 10:48Local Key Management
- 14:38Disk Encryption
- 15:37What is UFI
- 17:34What are 5 variables
- 18:29How to access 5 variables
- 20:57How cryptography works
- 21:51deterministic password managers
- 22:23basic operations
- 26:55typical process
- 30:20conclusions
related talks
38mHow to Distribute Keys Securely for 20% of the Web
29mManaging Secrets in Your Cloud Environment
29mBe nice, help the person who hacks your servers to get your data
29mBehind Closed Doors: Managing Passwords in a Dangerous World
43mSecret Management with Hashicorp's Vault
47mManaging your Secrets in a Cloud Environment
30mSimplifying Secrets Management in the Public Cloud
51mIntroduction to Vault