Skip to content

Commit

Permalink
[secure-storage] Diem -> Aptos
Browse files Browse the repository at this point in the history
  • Loading branch information
gregnazario committed Mar 11, 2022
1 parent d304884 commit fc8074f
Show file tree
Hide file tree
Showing 8 changed files with 13 additions and 13 deletions.
6 changes: 3 additions & 3 deletions secure/storage/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ custom_edit_url: https://github.com/aptos-labs/aptos-core/edit/main/secure/stora
---
# Secure Storage

Secure storage provides a secure, persistent data store for sensitive data in the Diem
Secure storage provides a secure, persistent data store for sensitive data in the
blockchain. Examples of sensitive data here include information required for safety and
identity within Diem, such as cryptographic keys and consensus safety rules, as well as
identity, such as cryptographic keys and consensus safety rules, as well as
run-time configuration data.

## Overview
Expand All @@ -30,7 +30,7 @@ both `KVStorage` and `CryptoStorage`:
Github repository.
- `Vault`: The Vault secure storage implementation uses the Vault Storage Engine (an engine
offered by HashiCorp: https://www.vaultproject.io/). The Vault secure storage implementation
is the one primarily used in production environments by nodes in the Diem blockchain.
is the one primarily used in production environments by nodes in the blockchain.
- `InMemory`: The InMemory secure storage implementation provides a simple in-memory storage
engine. This engine should only be used for testing, as it does not offer any persistence, or
security (i.e., data is simply held in DRAM and may be lost on a crash, or restart).
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/crypto_storage.rs
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ pub trait CryptoStorage {
/// This is not intended to be used in production and the API may throw unimplemented if
/// not used correctly. As this is purely a testing API, there is no defined behavior for
/// importing a key for a given name if that name already exists. It only exists to allow
/// Diem to be run in test environments where a set of deterministic keys must be generated.
/// running in test environments where a set of deterministic keys must be generated.
fn import_private_key(&mut self, name: &str, key: Ed25519PrivateKey) -> Result<(), Error>;

/// Returns the Ed25519 private key stored at 'name' and identified by 'version', which is the
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/in_memory.rs
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ use std::collections::HashMap;
/// threads (or must be wrapped by a Arc<RwLock<>>). This provides no permission checks and simply
/// is a proof of concept to unblock building of applications without more complex data stores.
/// Internally, it retains all data, which means that it must make copies of all key material which
/// violates the Diem code base. It violates it because the anticipation is that data stores would
/// violates the code base. It violates it because the anticipation is that data stores would
/// securely handle key material. This should not be used in production.
#[derive(Default)]
pub struct InMemoryStorage {
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/on_disk.rs
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ use std::{
/// intended for single threads (or must be wrapped by a Arc<RwLock<>>). This provides no permission
/// checks and simply offers a proof of concept to unblock building of applications without more
/// complex data stores. Internally, it reads and writes all data to a file, which means that it
/// must make copies of all key material which violates the Diem code base. It violates it because
/// must make copies of all key material which violates the code base. It violates it because
/// the anticipation is that data stores would securely handle key material. This should not be used
/// in production.
pub struct OnDiskStorage {
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/policy.rs
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ impl Permission {
}
}

/// Id represents a Diem internal identifier for a given process. For example, safety_rules or
/// Id represents an internal identifier for a given process. For example, safety_rules or
/// key_manager. It is up to the Storage and its deployment to translate these identifiers into
/// verifiable material. For example, the process running safety_rules may have a token that is
/// intended for only safety_rules to own. The specifics are left to the implementation of the
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/storage.rs
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ use aptos_crypto::ed25519::{Ed25519PrivateKey, Ed25519PublicKey, Ed25519Signatur
use enum_dispatch::enum_dispatch;
use serde::{de::DeserializeOwned, Serialize};

/// This is the Diem interface into secure storage. Any storage engine implementing this trait
/// This is the interface into secure storage. Any storage engine implementing this trait
/// should support both key/value operations (e.g., get, set and create) and cryptographic key
/// operations (e.g., generate_key, sign and rotate_key).
Expand Down
2 changes: 1 addition & 1 deletion secure/storage/src/tests/vault.rs
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ const VAULT_TESTS: &[fn()] = &[
test_vault_tokens,
];

/// A test for verifying VaultStorage properly implements the DiemSecureStorage API and enforces
/// A test for verifying VaultStorage properly implements the SecureStorage API and enforces
/// strict separation between unique namespaces. This test depends on running Vault, which can be
/// done by using the provided docker run script in `docker/vault/run.sh`
#[test]
Expand Down
8 changes: 4 additions & 4 deletions secure/storage/src/vault.rs
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,11 @@ use aptos_vault_client::ReadResponse;

const TRANSIT_NAMESPACE_SEPARATOR: &str = "__";

/// VaultStorage utilizes Vault for maintaining encrypted, authenticated data for Diem. This
/// VaultStorage utilizes Vault for maintaining encrypted, authenticated data. This
/// version currently matches the behavior of OnDiskStorage and InMemoryStorage. In the future,
/// Vault will be able to create keys, sign messages, and handle permissions across different
/// services. The specific vault service leveraged herein is called KV (Key Value) Secrets Engine -
/// Version 2 (https://www.vaultproject.io/api/secret/kv/kv-v2.html). So while Diem Secure Storage
/// Version 2 (https://www.vaultproject.io/api/secret/kv/kv-v2.html). So while Secure Storage
/// calls pointers to data keys, Vault has actually a secret that contains multiple key value
/// pairs.
pub struct VaultStorage {
Expand Down Expand Up @@ -315,11 +315,11 @@ pub mod policy {

const DIEM_DEFAULT: &str = "diem_default";

/// VaultStorage utilizes Vault for maintaining encrypted, authenticated data for Diem. This
/// VaultStorage utilizes Vault for maintaining encrypted, authenticated data. This
/// version currently matches the behavior of OnDiskStorage and InMemoryStorage. In the future,
/// Vault will be able to create keys, sign messages, and handle permissions across different
/// services. The specific vault service leveraged herein is called KV (Key Value) Secrets Engine -
/// Version 2 (https://www.vaultproject.io/api/secret/kv/kv-v2.html). So while Diem Secure Storage
/// Version 2 (https://www.vaultproject.io/api/secret/kv/kv-v2.html). So while Secure Storage
/// calls pointers to data keys, Vault has actually a secret that contains multiple key value
/// pairs.
pub struct VaultPolicy {
Expand Down

0 comments on commit fc8074f

Please sign in to comment.