Building Facebook’s Service Encryption Infastructure

For example, if engineers have access to a host running services with a particular identity, they should not be able to decrypt traffic from hosts from other identities — or even other hosts from the same identity forever. In addition to building Kerberos support and in-memory ticket caching into Thrift, to pre-fetch tickets, we also tuned thread pools to scale to large services and clients with tens of thousands of concurrent connections and made multiple improvements to the MIT Kerberos library. The ICA then verifies the identity certificate and generates three STEKs for the service using a key derivation function (KDF), like so:

The identity comes directly from the client identity in the mutually authenticated TLS connection.

Source: code.fb.com