/tags/encryption/Recent content in Encryption on Momo Engineering Journal/images/og-image.png/images/og-image.pngHugoen-usWed, 21 Oct 2026 11:26:56 -0600/posts/054-secrets-management-key-rotation/Tue, 25 Aug 2026 03:25:35 +0000/posts/054-secrets-management-key-rotation/How momo manages encryption keys without a central secret server: a pluggable provider chain (env, then config file), a per-node versioned key registry in local storage, and rotation that promotes a new key without any downtime. Teaches: why a provider chain beats a single source, how key versioning enables online rotation, and when rotation is and is not worth the complexity./posts/053-multitenancy-authorization-audit/Tue, 25 Aug 2026 03:25:29 +0000/posts/053-multitenancy-authorization-audit/How momo isolates tenants without a central secret server: HKDF-derived per-tenant keys, default-deny ACLs evaluated per request, and a SHA-256 hash-chained audit log that makes tampering detectable. Teaches: key derivation vs. key storage, why ACL evaluation order matters, and how hash chaining turns a log into evidence./posts/013-e2ee-envelope-encryption/Tue, 11 Aug 2026 16:36:53 +0000/posts/013-e2ee-envelope-encryption/Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports.