NOTE: This page is defunct and archived for historical purposes.

Warning: These are just rough notes. We are in the early stages of our discussions with ops, so this will definitely change.

Description

This is the service that will allow us to offer BrowserID Key Wrapping

• will store a user key per email address
• data inside the existing BrowserID database (but start with a separate and non-connected DB while in labs)
• the front-end servers will not write directly to the DB
• the service will live in a different subdomain (e.g. keywrapping.signin.persona.org)
• use lloyd's computer-cluster library for the CPU-intensive tasks

Questions

• what's our SLA on key-wrapping? i.e. what's the max time wrapping/unwrapping can take?
• do we need to worry about entropy if we're hosting this on VMs (at least initially)?

TODO

• find out how many emails (max and average) our existing BrowserID users have [petef]
• describe the backend flows (e.g. changing your password means unwrapping the user key, re-encrypting it with a new password, etc.)
• make a document like Scaling to 1M