Access management on the Tardigrade platform requires coordination of two parallel constructs:
Authorization - An API Key must be provided in order to access an object on the platform. API keys are based on macaroons.
Encryption - An HD Encryption Key must also be provided so that the object can be decrypted when it is accessed. Objects are encrypted with a randomized encryption key that is salted with a predetermined salt. Paths and randomized encr
Authorization
The API Keys issued by the satellite are based on Macaroons. A Macaroon is essentially a cookie with an internal structure. A Macaroon embeds the logic for the access it allows and can be restricted, simply by embedding the path restrictions and any additional restrictions within the string that represents the Macaroon. Unlike a typical cookie, a Macaroon is not a random string of bytes, but rather is an envelope with access logic encoded in it.
For more information, check out our engineer Paul’s awesome blog post on this very topic