At-Rest Integrity: Verify-on-Read, Checksums, and GC
CAS keys make verify-on-read free: central verification, x-amz-checksum echo, tombstone GC, and corruption surfacing.
Sentinel
Centralized Integrity Verification: Checksums Move to the Storage Core
S3 integrity checksums moved from a surface-level adapter into the storage/ingest core via a protocol-agnostic ChecksumProvider seam — every write path verified, replicas re-verify on receive.
S3 Integrity Checksums: x-amz-checksum-*
x-amz-checksum-CRC32/SHA256 echo on PUT; integrity surfaced to clients so dirty bytes never masquerade as clean. Teaches: client-verifiable integrity, Bolt zero-allocation on read path, Sentinel honesty guarantee.
Confidential Dedup via Threshold OPRF — and Auth Lockout
Threshold-OPRF lets E2EE cas blobs dedup without revealing content hashes — plus adaptive failed-auth backoff and lockout.
S3 Multipart and Protocol Breadth: 501 Discipline
Multipart upload support plus a rigorous 501 strategy for unsupported S3 subresources — honest breadths over silent misbehavior.
S3 and Inbound TLS: HTTPS-by-Default Enforcement
The S3 gateway turned HTTPS-or-explicit-insecure into the default: no silent plaintext for the gateway or inbound tcp/quic.
S3 Auth: SigV4, Presigned URLs, and Key Decoupling
Query-string SigV4 for presigned URLs, mandatory X-Amz-Date freshness, and decoupling gateway access/secret keys from the native auth token.
S3 Gateway Core: XML, Buckets, Objects, Lists
The S3 gateway: SigV4, S3-compliant XML errors, Head/List/Copy, pagination, ranges, and metadata — a compatible API surface for real clients.
Client-Held E2EE: Envelope Encryption Real
Envelope encryption with a client-held key: the server stores ciphertext and can’t read it — across S3 and native transports.
Signed Payloads and Server-Sent Events for S3
SigV4 signed payload verification for S3 PUT/POST and Server-Sent Events for async operation notifications.