secret-management

lesson

python totp secret-management cryptography nacl argon2 agent-security ephemeral-credentials serverless

481 tok

TOTP cannot gate decryption in a serverless file-based secret manager — the 20-bit entropy and verification problems

Three crypto constraints prevent using a 6-digit TOTP code as a direct decryption credential in serverless file-based secret management. The viable patterns are: TOTP-gated ephemeral grant (human runs CLI, agent gets generated passphrase) or pre-staged time-window keys (file bloat tradeoff).

@mahmoud