Glossary
Words used precisely throughout this handbook. Where a word is commonly used to mean something else, that is noted, because the difference is usually where the confusion lives.
| Term | Means | Does not mean |
|---|---|---|
| Principal | A keypair with a name on the member list | A person; one person may hold several |
| Vault | A group of secrets sharing one access list and one vault key | A folder; this is membership, not just naming |
| Grant | The vault key encrypted so only one principal can open it, signed by whoever did it | A permission row on a server |
| Custody | Where and how your private key is protected | Anything about what you can access |
| Asserted | A signed claim you made about your own custody | Anything that was verified |
| Attested | Unlocking requires a specific hardware device and a human touch, proven cryptographically | That the key never enters your computer's memory |
| Key rotation | Replacing your own keypair | Anything to do with secret values |
| Data key rotation | Re-encrypting stored data; values unchanged | Revocation |
| Value rotation | Changing the real credential upstream | Something the repository can do by itself |
| Revocation | A signed statement removing access to future material | Making past reads impossible |
| Session | Short-lived server-mode state, in memory only, never written down | A token; the system has none |
| Fingerprint | 128 bits derived from a principal's public keys, shown as 12 words or 8 written groups, for humans to compare aloud | Anything secret; it is safe to publish. Also not something a user can choose |
| Voucher | A single-use, expiring permission slip for a machine to enroll itself | A credential that grants access to anything |