RFD 0301 defines Oxide rack secret via Shamir shares across N sleds with K-of-N reconstruction

Oxide RFD 0301 outlines a Trust Quorum where a dealer splits the rack secret into N shares and delivers them with platform certificates to sled bootstrap agents. Reconstruction requires K shares from verified members before any drive-level keys can be derived or unwrapped. Shares remain unencrypted on M.2 drives until future RoT sealing is implemented.

RFD 238 establishes the underlying sprockets protocol and attestation guarantees while RFD 36 defines the RoT key hierarchy that roots all subsequent derivations. The design prevents subset theft by enforcing both physical quorum and cryptographic verification; an attacker must obtain K intact sleds and achieve boot-time unsealing.

Operationally this binds encryption of U.2 devices and internal service certificates to rack membership rather than individual hardware. Key compromise triggers rack secret rotation and re-distribution of new shares without exposing prior wrapped material. Spatial locality is enforced by requiring concurrent presence inside the same rack fabric.

Next steps include RoT-based sealing of shares and extension of the hierarchy to cluster-level secrets. Implementation will be tracked in subsequent RFDs once the current K threshold and share storage are hardened.