A stateless server for binding data decryption to network presence using asymmetric cryptography, providing a secure alternative to key escrow.
Tang is a server daemon that binds data decryption to network presence, allowing data to be encrypted so it can only be accessed when the client is on a specific network. It uses asymmetric cryptography and a stateless design to provide a secure alternative to traditional key escrow systems, eliminating the need for TLS, authentication, and complex state management.
System administrators and security engineers who need to automate decryption of data (e.g., disk encryption keys) based on network location, particularly in environments where key escrow complexity is undesirable.
Developers choose Tang for its simplicity, stateless architecture, and strong security model that avoids the pitfalls of key escrows—no TLS requirements, no client authentication, and no stored keys—while providing robust network-bound encryption.
Tang binding daemon
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Tang stores no client keys or state, eliminating backup complexities and simplifying deployment compared to key escrows, as highlighted in the README's comparison table.
Operates securely without mandatory SSL/TLS, reducing attack surface and operational overhead, which the README notes avoids issues like Heartbleed.
Clients can provision and recover keys without revealing identity to the server, ensuring privacy as described in the protocol's blinding mechanism.
Uses JSON Object Signing and Encryption standards, enabling integration with off-the-shelf libraries and tools for easy client implementation.
Building from source requires managing dependencies like llhttp or unmaintained http_parser, with the README noting availability issues on Debian and CentOS.
Key rotation is a manual, three-step process with timing risks, as the README warns about deleting old keys only when no clients need them.
Lacks integrated audit logging, access control, or monitoring tools, requiring additional setup for comprehensive security management.