🔑 Key Management / HSM

Non-Exportable Keys, Envelope Encryption & Audit-Grade Control

Key Management governs the creation, storage, use, rotation, and retirement of cryptographic keys.
SolveForce designs key management with HSMs (Hardware Security Modules), cloud KMS, and vaults so your keys are non-exportable, audited, and available—powering encryption, signing, tokenization, and identity across apps, cloud, and data centers.

Where key management fits in our system:
🔒 Security (Semantics) → Cybersecurity • 🧾 Identity → IAM / SSO / MFA • 🔐 Encryption → Encryption
🪪 Certificates/Trust → PKI • 🗝️ Secrets (tokens/passwords) live alongside keys in controlled vaults
📊 Evidence/Automation → SIEM / SOAR • 🧰 Privileged control → PAM • 🌩️ Cloud → Cloud

🎯 Outcomes (What “good” key management delivers)

  • Non-exportable keys (HSM/KMS protected) with quorum/dual-control on destructive actions.
  • Envelope encryption (root → key-encryption keys (KEKs) → data-encryption keys (DEKs)) that scales.
  • Rotation & revocation with zero data loss (re-wrap/re-encrypt design).
  • Low-latency cryptographic operations with regional/high-availability design.
  • Audit-grade evidence for PCI DSS, ISO 27001, HIPAA, FedRAMP, NIST 800-57/53.

🧱 Building Blocks (Spelled out)

  • HSM (Hardware Security Module) — FIPS 140-2/140-3 validated hardware where root/KEKs live as non-exportable keys; tamper-evident & access-controlled.
  • Cloud KMS — AWS KMS / Azure Key Vault / Google Cloud KMS; regional HA, key policies, aliasing, grants, envelope encryption APIs. → Cloud
  • Vault — secrets + key orchestration (e.g., app credentials, API tokens); policy engine, dynamic secrets, lease/TTL, audit logs.
  • Key hierarchy — Root (HSM) → KEKs (service/tenant/env) → DEKs (per dataset/object/record).
  • Control plane — policy/RBAC/ABAC, quorum (M-of-N) for delete/export, dual-control for rotation/unwrap, approvals via ITSM.

🔐 Key Types & Uses (Practical map)

  • Symmetric (AES-GCM/CTR/XTS) — volume/disk (TDE), backups, object storage, per-record encryption.
  • Asymmetric (RSA/ECC/Ed25519) — TLS termination, JWT signing (JWKS), code/container signing, firmware, FIDO/WebAuthn. → PKI
  • Wrapping keys (KEKs) — protect DEKs; enable envelope encryption and re-wrap at rotation.
  • Session/data keys (DEKs) — short-lived, cached near apps for speed; never stored in the clear.
  • Signing keys — CI/CD artifact signing (Sigstore/Cosign), S/MIME, email DKIM, API tokens.

🧭 Envelope Encryption (How it scales without pain)

  1. Generate DEK (app/KMS) → encrypt data.
  2. Wrap DEK with KEK (in HSM/KMS) → store wrapped DEK alongside ciphertext.
  3. Rotate KEK → re-wrap DEKs (no data re-encrypt).
  4. Rotate DEKs → re-encrypt new data; bulk jobs re-encrypt old as policy allows.
  5. Revoke → mark KEK/DEK as disabled; re-key path documented; evidence preserved.

Result: rotation is fast and safe; destructive access requires quorum; audit logs are complete.

🧰 Operations & Lifecycle (end-to-end)

  • Generate — HSM-backed RNG; track key attributes (alg, size, purpose, expiry).
  • Distribute — apps fetch wrapped keys or use KMS data key APIs; no raw key export.
  • Use — encrypt/decrypt/sign/verify via SDKs/agents; cache DEKs with TTL; throttle misuse.
  • Rotate — time-based (e.g., 90/180 days) and event-driven (incident, staff change, cert change).
  • Backup/Escrow — HSM key backups re-wrapped with separate HSM or M-of-N shards (Shamir); off-site sealed storage.
  • Retire/Destroy — scheduled disable, cryptographic erase, dual approval, evidence pack.

🧩 App Integration Patterns

  • JWT signing & rotation — kid headers + JWKS endpoint; pre-publish new public keys; drain old tokens.
  • Database TDE — master key in HSM/KMS; DEKs per tablespace/DB; rotate KEK → re-wrap TDE keys.
  • Object storage — SSE-KMS/RSA wrapping; per-bucket or per-object DEKs.
  • Code signing — non-exportable private keys; signer service with approvals; attestations attached to artifacts.
  • TLS private keys — HSM offload for servers; ACME automation for cert renewals.
  • Tokenization — map PAN/PII → surrogate tokens; KEKs protect token vault. → DLP

🔒 Access Controls (no single person can burn the house down)

  • RBAC/ABAC for key admin, crypto users, auditors (least privilege).
  • Quorum (M-of-N) for delete/export/unlock; dual-control for rotation.
  • Separation of duties — ops vs security vs audit; approvals via ITSM with change IDs.
  • Just-in-Time (JIT) elevation through PAM; session recording for privileged actions. → PAM
  • Conditionals — source IP/ASN, device posture, time windows; emergency break-glass with hard tokens.

📈 SLO Guardrails (experience + safety you can prove)

SLOTarget (Recommended)Notes
KMS encrypt/decrypt p95≤ 10–30 ms per callRegional KMS/HSM + DEK caching
Signing/verify p95≤ 20–50 msJWT/code-sign flows
Service availability≥ 99.99%Multi-region or HA cluster
Rotation SLA (KEK)≤ 24–72 h end-to-endNo data loss (re-wrap only)
Audit export completeness100% of key eventsImmutable/WORM store
Quorum approval time (critical)≤ 30–60 minOn-call matrix, redundant approvers

Monitor KMS/HSM latency, error rate, throttles, and tamper alarms in SIEM. → SIEM / SOAR

📜 Compliance Mapping (examples)

  • PCI DSS 3.5/3.6 — key protection, rotation, split knowledge & dual-control, key lifecycle docs.
  • ISO/IEC 27001 / 27002 — cryptographic controls, key management policy, audit evidence.
  • HIPAA — encryption & integrity controls for ePHI; key custody evidence.
  • NIST SP 800-57 — key management lifecycles; SP 800-53 SC-12/SC-13 crypto controls.
  • FedRAMP — HSM/KMS posture, key residency, audit logging & retention.

🔭 Observability & Evidence (prove everything)

  • Audit streams — key create/disable/destroy, grant/deny, encrypt/decrypt/sign/verify.
  • Tamper events — HSM chassis alarms, policy changes, failed quorum.
  • Usage analytics — top keys by calls, latency heatmaps, unexpected burst detection.
  • Chain-of-custody — hash & seal evidence; WORM retention; case linkage.

🧪 Safety Nets & Testing

  • Game days — simulate KEK rotation, DEK re-wrap, HSM failover, and region outage.
  • Restore drills — test HSM backups (M-of-N) and cold-start procedures.
  • Kill-switch — quickly disable a key (deny decrypt/sign) with documented business impact path.
  • Backout plan — re-enable previous KEK, revert aliases, re-publish JWKS.

🧰 Implementation Blueprint (No-surprise rollout)

  1. Inventory & classification — keys/secrets by purpose (encrypt, sign, wrap), sensitivity, residency.
  2. Choose platforms — HSM cluster + cloud KMS + vault; decide HA/DR regions.
  3. Design hierarchy — root in HSM, KEKs per service/tenant/env, DEKs per dataset/object.
  4. Access policy — RBAC/ABAC, M-of-N quorum, dual-control steps, break-glass, ITSM change.
  5. Integrate apps (SDKs/agents), DBs (TDE), storage (SSE-KMS), CI/CD signers, JWT JWKS rotation.
  6. Observability — export audit to SIEM; define SLOs & tamper alerts; SOAR playbooks for revoke/disable.
  7. Compliance packs — policy docs, key lifecycle SOPs, rotation calendar, evidence exports.
  8. Drills — rotation, restore, disable; publish RCAs & improvements.

✅ Pre-Engagement Checklist

  • 📦 Data & app inventory (what needs encryption/signing; where keys live now).
  • 🗺️ Residency & sovereignty (where keys must live; customer-managed vs provider-managed).
  • 🛡️ HSM/KMS choices, FIPS level, region/HA/DR plan.
  • 👥 RBAC/ABAC roles, M-of-N thresholds, approval matrix (ITSM).
  • 🔐 Integrations (DB TDE, object storage SSE-KMS, JWT JWKS, CI/CD signing).
  • 📊 SIEM dashboards, SOAR playbooks (revoke/disable/rotate), tamper alerts.
  • 🧾 Compliance targets (PCI/HIPAA/ISO/NIST/FedRAMP) & evidence format.

🔄 Where Key Management Fits (Recursive View)

1) Grammar — crypto rails ride Connectivity & the Networks & Data Centers fabric.
2) Syntax — delivery patterns in Cloud use KMS/HSM & envelope encryption.
3) Semantics — Cybersecurity preserves truth; keys prove identity & integrity.
4) Pragmatics — SolveForce AI flags anomalies, predicts key hot spots, and assists rotations.
5) Foundation — consistent terms via Primacy of Language.
6) Map — indexed in the SolveForce Codex & Knowledge Hub.

📞 Design Key Management That Won’t Fail You

Related pages:
Encryption • PKI • IAM / SSO / MFA • PAM • SIEM / SOAR • DLP • Cloud • Cybersecurity • Knowledge Hub