Cryptography
The cryptographic algorithms Citrix SecurSpaces™ uses, and where each one applies. This page supports network security review and third-party assessment.
Data in transit
| Traffic | Protection |
|---|---|
| Browser and API traffic from outside the cluster | HTTPS. TLS is terminated at the ingress controller. |
| Ingress controller to SecurSpaces services | TLS |
| SecurSpaces service to SecurSpaces service | TLS |
| Remote development sessions | SSH |
Note:
Because TLS is terminated at the ingress controller, the permitted TLS versions and cipher suites for external traffic are determined by your ingress configuration, not by SecurSpaces. Set them to meet your own policy.
Data at rest
SecurSpaces is customer-hosted, so encryption at rest for the database, persistent volumes, and
etcd is your responsibility. SecurSpaces adds application-layer encryption on top of it.
| Data | Protection |
|---|---|
| Developer and application secrets stored in the database | AES-128-GCM, when the external Vault integration is not in use |
Database, persistent volumes, etcd |
Your infrastructure encryption, such as cloud provider KMS or encrypted Kubernetes persistent volumes |
Keys and certificates
| Purpose | Algorithm |
|---|---|
| Application secret encryption | AES-128-GCM |
| API tokens | AES-GCM |
| Personal SSH identities | Ed25519 |
| SAML signing certificate, when SecurSpaces acts as the identity provider | RSA 2048 |
| Token signing | JSON Web Token signing keys, held as Kubernetes Secrets |
| TLS | X.509 certificates |
SecurSpaces supports automated certificate lifecycle management for external traffic, such as cert-manager, Let's Encrypt, or an internal PKI. It manages the certificates for internal cluster traffic itself.
Secret storage
| Secret | Where it is held |
|---|---|
| Developer and application secrets | Encrypted in the database, or in an external HashiCorp Vault instance when that integration is enabled |
| Certificates, access keys, encryption keys, database credentials, token signing keys | Kubernetes Secrets, stored in etcd |
Kubernetes Secrets are stored in
etcd, which you must protect with encryption at rest. For stronger separation, SecurSpaces works with the Secrets Store CSI Driver and External Secrets Operators.