// Module included in the following assemblies:
//
// security/nbde-implementation-guide.adoc

:_mod-docs-content-type: REFERENCE
[id="nbde-using-tang-servers-for-disk-encryption_{context}"]
= Tang server disk encryption

The following components and technologies implement Network-Bound Disk Encryption (NBDE).

[[fig-NBDE-Clevis-Tang]]
.NBDE scheme when using a LUKS1-encrypted volume. The luksmeta package is not used for LUKS2 volumes.
image::179_OpenShift_NBDE_implementation_0821_3.png[Network-Bound Disk Encryption (NBDE), Clevis framework, Tang server]

_Tang_ is a server for binding data to network presence. It makes a node containing the data available when the node is bound to a certain secure network. Tang is stateless and does not require Transport Layer Security (TLS) or authentication. Unlike escrow-based solutions, where the key server stores all encryption keys and has knowledge of every encryption key, Tang never interacts with any node keys, so it never gains any identifying information from the node.

_Clevis_ is a pluggable framework for automated decryption that provides automated unlocking of Linux Unified Key Setup-on-disk-format (LUKS) volumes. The Clevis package runs on the node and provides the client side of the feature.

A _Clevis pin_ is a plugin into the Clevis framework. There are three pin types:

TPM2:: Binds the disk encryption to the TPM2.
Tang:: Binds the disk encryption to a Tang server to enable NBDE.
Shamir’s secret sharing (sss):: Allows more complex combinations of other pins. It allows more nuanced policies such as the following:

* Must be able to reach one of these three Tang servers
* Must be able to reach three of these five Tang servers
* Must be able to reach the TPM2 AND at least one of these three Tang servers
