Oxide Implements Trust Quorum for Rack-Level Security Using Shamir Secret Sharing

Foundation of Rack Security

Oxide's rack security begins with DeviceId and Alias keys stored on the Root of Trust (RoT), which are used for platform identity and measurement signing for attestation. A third RoT-hosted keypair authenticates ephemeral Diffie-Hellman agreements, enabling sleds to establish secure sprockets sessions for application layer messages. These sessions ensure confidential, point-to-point information sharing with protected message integrity and authenticated, attested endpoints.

Introducing the Trust Quorum

To provide rack-level security and prevent attackers from recovering useful information by stealing a subset of sleds or drives, Oxide designed a Trust Quorum. This mechanism's primary protection is Shamir Secret Sharing, which secures a shared rack-level secret used as a key-derivation source for other keys protecting data at rest.

Secret Distribution and Reconstruction

A dealer process splits the rack secret into N unique key shares and distributes them to each bootstrap agent via sprockets sessions, along with the unique platform identities of the N Trust Quorum members. These identities are embedded in public key certificates on the RoT for verification. Bootstrap agents can then establish connections, verify group membership, and retrieve K-1 shares from other agents to reconstruct the rack secret from K shares. Without obtaining K shares, no information about the rack secret can be learned.

Physical Security Measures

Individual shares are stored unencrypted on each sled's M.2 drives. An attacker would need to steal at least K of these drives to reconstruct the rack secret, which is considered infeasible without significant time and physical disruption. Future plans include "sealing" these secrets with the RoT, so they are only decrypted on sled boot. This would require an attacker to steal K whole sleds and boot them to recover the rack secret, making the attack prohibitive due to the weight and logistical challenges of moving multiple sleds.