Using multiple encryption keys

[tarun360]

Currently buildah push provides --encryption-key flag which allows us to specify encryption key and protocol, and the --encrypt-layer flag to specify which layers to encrypt.

Is there a way to use different encryption keys for different layers? If a image contains lot of layers, using different encryption keys for different set of layers would increase image security and also decrease the consequences of leakage of a single key.

[rhatdan]

Could you build this yourself using scripting?
I think attempting to do this via the CLI would be incredibly complex.
@vrothberg @mtrmac Thoughts.

[tarun360]

using scripting

Could you give some more information on how this can be done using scripting? If there's some article/blog-post on this that you are aware of, that would be helpful.

Thanks

[mtrmac]

I imagine a sequential application of skopeo copy --encryption-key1 --encrypt-layer set1 + skopeo copy --encryption-key2 --encrypt-layer set2 … might work, at least reading the code. You would probably be the first one to try.

[tarun360]

@mtrmac Thanks, that indeed works.

While decrypting the image we can provide all the decryption keys using --decryption-key flag and it will try each decryption key against each layer.