Docs

Backups, pairs and key pieces

Roost stores no complete key anywhere. A key that must survive a failed chip or a failed box is split into pieces: any two of three pieces rebuild it, and each chip locks its own piece with its own physical fingerprint. There is no domain secret carried by people.

Inside one box

The three voter chips each hold one piece. A failed chip does not lose the key; a stolen piece is useless on its own; using the key needs two chips to cooperate, which is the same rule as signing.

A pair of boxes

Roost is sold in pairs. The second box joins the first box's domain: the first box's chips send pieces to the second box's chips, each piece encrypted for the receiving chip, after the joining ceremony below. Both boxes then serve the same keys, and a client fails over between them.

Joining ceremony

roost domain join ROOST-26-0002 --from ROOST-26-0001
# 1. the new box proves it is a Roost with its attestation key and a measurement match
# 2. security officers approve with passkeys (M of N from the quorum policy)
# 3. pieces move chip to chip, encrypted for each receiver
# 4. the join is recorded in the audit chain

Backup box

A third box at another site joins the same way and receives pieces only. It serves no application until it is promoted, which needs the same approvals. If every box in a domain is destroyed at once, the keys are gone: keep one box elsewhere.