Encryption

Rotating Secrets Without a Secret Server: Deriving, Versioning, and Hot-Reloading Keys

How momo manages encryption keys without a central secret server: a pluggable provider chain (env, then config file), a per-node versioned key registry in local storage, and rotation that promotes a new key without any downtime. Teaches: why a provider chain beats a single source, how key versioning enables online rotation, and when rotation is and is not worth the complexity.

Tenant Isolation: Deriving Per-Tenant Keys, Enforcing ACLs, and Proving What Happened

How momo isolates tenants without a central secret server: HKDF-derived per-tenant keys, default-deny ACLs evaluated per request, and a SHA-256 hash-chained audit log that makes tampering detectable. Teaches: key derivation vs. key storage, why ACL evaluation order matters, and how hash chaining turns a log into evidence.

Client-Held E2EE: Envelope Encryption Real

Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports.