Redis with Findex

The KMS can store its entire database in Redis using the Redis-with-Findex backend. Redis-with-Findex combines application-level encryption with encrypted, searchable indexes, so the KMS can query encrypted data without revealing it to the Redis server.

Configuration

Redis-with-Findex requires the database URL and a master password:

[db]
database_type = "redis-findex"
database_url = "redis://localhost:6379"
redis_master_password = "password"
redis_findex_label = "label"

--database-type=redis-findex \
--database-url=redis://localhost:6379 \
--redis-master-password=password \
--redis-findex-label=label

The corresponding environment variables are KMS_DATABASE_TYPE, KMS_DATABASE_URL (also KMS_REDIS_URL), KMS_REDIS_MASTER_PASSWORD, and KMS_REDIS_FINDEX_LABEL.

For the full database configuration reference, including TLS, clearing, and migration, see Databases.

What it is

With Redis-with-Findex, the KMS server encrypts all data before sending it to Redis:

• Objects and permissions are encrypted with AES-256-GCM using a key derived from a master password.
• Indexes are built with Findex, an Eviden cryptographic algorithm that produces encrypted indexes over encrypted data. The indexes are also stored in Redis, allowing fast encrypted queries (for example Locate by tag or attribute) without the KMS ever sending plaintext to Redis.

Redis-with-Findex provides post-quantum resistance on both the encrypted data and the encrypted indexes.

When to use it

Redis-with-Findex is most useful when:

• The KMS servers run inside a confidential VM or an enclave. In this case the secret used to encrypt the Redis data and indexes is protected by the VM or enclave and cannot be recovered at runtime by inspecting the KMS servers' memory.
• The KMS servers are run by a trusted party, but the Redis backend is managed by an untrusted third party.

It is the database selected to run the Eviden KMS in the cloud or any other zero-trust environment.

How encryption keys are derived

1. A master password is provided at startup (redis_master_password).
2. A 32-byte master key is derived from the password using Argon2 (salt rediswithfindex_).
3. A database key is derived from the master key (salt db) and is used to encrypt the object and permission data with AES-256-GCM.
4. The master key is also used by the Findex encryption layer to encrypt the searchable indexes.

The master password never leaves the KMS server; only the derived keys are used in memory.

Data layout in Redis

Redis-with-Findex does not use relational tables (see Database tables for the SQL schema). Instead it stores:

Migration

Version boundary: Redis-with-Findex databases created with KMS 5.12.0 or later carry a ready state marker and a version key in Redis, and start cleanly with the current KMS (5.26). Databases created with KMS earlier than 5.12.0 do not have these markers. The KMS refuses to start against a marker-less database and prints an error asking you to export and re-import; there is no in-place upgrade path for those databases.

Supported upgrade paths: