49PLATFORM SECURITY

Cryptography & Key Management

Use cryptography to prove identity and integrity; do not invent cryptographic algorithms.

Priority: P0
Phase: Foundation
Primary owner: Security Eng / SRE
Status: Blueprint

Objective

Cryptographic design should support secure service identity, signed policy bundles, protected secrets and evidence integrity. Avoid custom cryptography; use mature cloud/HSM/KMS primitives and documented rotation procedures.

What to build

TLS everywhere; mTLS for sensitive service/gateway paths.
Envelope encryption for sensitive data stores.
KMS/HSM-backed signing keys for tokens, policy bundles and evidence manifests.
Per-tenant key options for enterprise requirements.
Key rotation, revocation and disaster-recovery procedures.

Implementation decisions

Separate encryption keys from application data and least-privilege KMS access.
Track key version in signed/ encrypted artifacts for historical verification.
Automate rotation and alert on overdue keys/certificates.
Never hard-code secrets or private keys in code/build artifacts.

Definition of done

Rotation can occur without prolonged outage.
Compromised key can be revoked and impact scoped.
Evidence signed with an old key remains verifiable according to policy.

Success metrics

Key age
Rotation compliance
Certificate expiry risk
KMS access anomalies

RULE

Use cryptography to prove identity and integrity; do not invent cryptographic algorithms.