Key management
A key is a liability with an expiry date, not a configuration value.
The hardest part of enterprise cryptography is not encrypting data — it is knowing every key that exists, who is accountable for it, when it must change, and being able to prove you can revoke it under pressure. This page models that inventory and the lifecycle discipline around it.
Keys tracked
7
Within rotation SLA
3/7
Overdue → risk register
3
Lifecycle model
Seven stages, each with an owner and an exit condition
Stages map back to catalog controls so the model is not decorative — a failure at any stage produces a named finding.
Plan
Classify the data, pick from the approved catalog, record the intended key lifetime and blast radius.
Generate
Keys are created inside the HSM-backed KMS. No key material exists outside a validated boundary.
Distribute
Workloads receive short-lived grants via workload identity; no static secrets in code or images.
Use
All crypto calls go through the shared SDK, which enforces AAD, nonce discipline, and audit logging.
Rotate
Dual-version aliases allow zero-downtime re-wrapping. Overdue keys raise an automatic risk item.
Revoke
Compromise playbook disables the key, re-wraps dependents, and files an incident record with timings.
Destroy
Scheduled deletion after retention proof; crypto-shredding evidence attached to the data disposal record.
Inventory
Synthetic key register with rotation posture
Age is measured against the SLA for the key's purpose: 90 days for signing keys, 180 for shared partner secrets, 365 for data-wrapping keys.
| Alias | Purpose | Algorithm | Custodian | Age / SLA | Status |
|---|---|---|---|---|---|
| alias/lab-tenant-data-eu | Wrap tenant DEKs (EU region)Confidential | AES-256 (HSM CMK) | Platform Data Services | 141d / 365d | In SLA |
| alias/lab-tenant-data-us | Wrap tenant DEKs (US region)Confidential | AES-256 (HSM CMK) | Platform Data Services | 318d / 365d | Due soon |
| alias/lab-artifact-signing | Sign container digestsIntegrity | ECDSA P-256 | Platform Engineering | 96d / 90d | Overdue |
| alias/lab-session-jwt | Sign session assertionsIdentity | EdDSA Ed25519 | Identity & Access Management | 41d / 90d | In SLA |
| alias/lab-partner-hmac-acme | Webhook integrity (synthetic partner)Integrity | HMAC-SHA-256 secret | Integration Engineering | 402d / 180d | Overdue |
| alias/lab-backup-archive | Encrypt long-retention archivesConfidential (10y retention) | AES-256-GCM | Resilience Engineering | 233d / 365d | In SLA |
| alias/lab-legacy-partner-rsa | Partner payload decryptionConfidential (deprecating) | RSA-2048 OAEP | Security Architecture | 731d / 365d | Overdue |
Aliases, ages and custodians are invented for this demonstration. No key material, KMS account, or partner relationship shown here exists.
Assurance
Rotation without downtime, revocation under pressure
Zero-downtime rotation pattern
t0 encrypt → key v1 decrypt → v1 t1 create v2 (KMS, non-exportable) t2 encrypt → key v2 decrypt → v1, v2 t3 background re-wrap of stored DEKs under v2 t4 encrypt → key v2 decrypt → v2 t5 disable v1, retain for audit window, then schedule deletion
The dual-decrypt window is what makes rotation boring. Skipping it is how teams end up afraid to rotate at all — which is the real failure mode.
Compromise drill (semi-annual, synthetic)
- T+0 minSuspected exposure reported; key marked untrusted, alias frozen.
- T+2 minGrants revoked; workloads fail closed on that key and alert.
- T+4 minNew CMK generated in HSM; alias repointed for encrypt operations.
- T+11 min4,200 synthetic DEKs re-wrapped; decrypt-only on old key disabled.
- T+1 dayIncident record filed with timings; runbook gaps become backlog items.
The drill exists to produce a measured number. “We can revoke a key” is a claim; “11 minutes, evidenced twice a year” is a control.