Governance
Decisions with recorded consequences, reviewed on a cadence, sequenced by risk.
Governance is where a cryptography program either compounds or decays. This page shows the four artifacts that keep it compounding: an approved algorithm catalog with an explicit deprecation list, decision records that admit their trade-offs, a review calendar, and a risk register that turns findings into dated waves of work.
Educational portfolio demonstration. The decision records, cadences and risk items below model a fictional program on synthetic data. The algorithm guidance reflects current public standards guidance, but nothing here constitutes a compliance assessment or a security guarantee.
Approved catalog
What is allowed, what is being removed, and why
Developers should not have to make cryptographic judgement calls under delivery pressure. The catalog answers the question before it is asked.
| Use case | Approved | Deprecated / prohibited | Rationale |
|---|---|---|---|
| Symmetric encryption (at rest / in transit payloads) | AES-256-GCM, ChaCha20-Poly1305 | AES-CBC without authenticated MAC, 3DES, RC4 | Authenticated encryption removes an entire class of tampering and padding-oracle bugs. |
| Deterministic encryption (equality search only) | AES-256-SIV | ECB mode, unsalted hashing as pseudo-encryption | Determinism leaks equality; allowed only on an explicit, reviewed column allow-list. |
| Key exchange | X25519, ECDH P-256, X25519+ML-KEM (pilot) | Static RSA key transport, DH < 2048-bit | Forward secrecy is mandatory; hybrid PQC hedges long-lived confidentiality. |
| Digital signatures | Ed25519, ECDSA P-256, ML-DSA (evaluation) | RSA-1024, DSA, RSA-PKCS#1 v1.5 for new work | Smaller, faster, and fewer implementation footguns than legacy RSA padding. |
| Hashing / integrity | SHA-256, SHA-384, SHA3-256, BLAKE3 (non-compliance paths) | MD5, SHA-1 | Collision resistance is required wherever a hash names or authorizes something. |
| Password storage | Argon2id, scrypt, bcrypt (cost >= 12, legacy only) | Any plain or salted fast hash | Memory-hard functions make offline cracking economically unattractive. |
| Randomness | OS CSPRNG (getrandom, WebCrypto getRandomValues) | Math.random, time-seeded PRNGs, custom generators | Predictable randomness silently invalidates every other control. |
Decision records
Architecture decisions and their honest consequences
An ADR that lists only benefits is marketing. Each record here names the new burden the decision creates and who absorbs it.
AES-GCM over AES-CBC for all new at-rest encryption
Context. Two legacy services used AES-CBC with a separate HMAC, creating room for padding-oracle and ordering mistakes.
Decision. Standardize on AES-256-GCM through the shared SDK with mandatory additional authenticated data carrying tenant and record identifiers.
Consequence. Nonce management becomes the critical risk, so the SDK owns nonce generation and rejects caller-supplied nonces.
Argon2id replaces bcrypt for credential hashing
Context. bcrypt cost factor had not been revisited in four years and offers no memory hardness.
Decision. Argon2id with tuned memory cost; transparent upgrade-on-login for existing hashes.
Consequence. Higher memory per auth request; auth tier capacity plan updated and load-tested.
Hybrid post-quantum key exchange on external ingress first
Context. Confidential data with a 10-year retention window is exposed to harvest-now-decrypt-later interception risk.
Decision. Pilot X25519 + ML-KEM hybrid key exchange on the ingress tier before touching internal mesh or signing paths.
Consequence. Adds handshake size and requires client compatibility testing; signing migration is deliberately deferred.
No application-managed key material
Context. Two teams had proposed loading private keys from environment variables for latency reasons.
Decision. All private keys stay non-exportable in KMS/HSM; latency addressed with DEK caching, not key export.
Consequence. A cache invalidation path is required, and cache TTL is capped at 5 minutes.
Operating rhythm
Review cadence
Every cadence produces a named output. If an activity has no output, it is a meeting, not a control.
| Cadence | Activity | Output |
|---|---|---|
| Weekly | Rotation and drift dashboard triageSecurity Engineering | New risk items with owner and due date |
| Per change | Crypto design review gate on new data stores or external integrationsSecurity Architecture | Approved cipher suite + ADR reference |
| Quarterly | Control attestation and evidence refreshControl owners | Signed attestation pack for audit |
| Semi-annual | Key compromise and revocation drillSecurity Engineering + Incident Response | Timed drill report, runbook updates |
| Annual | Algorithm catalog and PQC roadmap reviewSecurity Architecture | Updated approved/deprecated algorithm list |
Evidence pack contents
What an auditor or enterprise customer actually receives each quarter, assembled from artifacts the controls already generate rather than written from scratch.
- Control register extract with owner sign-off dates
- Key inventory with age, SLA and custodian per key
- Rotation and revocation drill report with timings
- TLS posture scan summary and documented exceptions
- Cryptographic bill of materials and PQC migration waves
- Open risk items with treatment, owner and due wave
Risk register
Findings sequenced into remediation waves
Prioritisation is by data lifetime and blast radius, not by how easy the fix is. Long-lived confidential data outranks convenience every time.
Artifact signing key past 90-day rotation SLA
Treatment. Rotate key and enable automated rotation with dual-alias verification.
Platform Engineering · Wave 1 — current quarter
Legacy partner endpoints negotiate TLS 1.2
Treatment. Partner migration campaign with a hard cutoff date and documented exception until then.
Cloud Network Engineering · Wave 2
RSA-2048 protecting data with 10-year retention
Treatment. Hybrid PQC key exchange on ingress, then re-encrypt archives under PQC-safe wrapping.
Security Architecture · Wave 3
Three regulated columns still use application-layer hashing
Treatment. Migrate to AES-256-SIV where equality search is genuinely required; drop the rest.
Application Security · Wave 1