Security Model

Threat model, security invariants, and vulnerability disclosure.

Trust boundaries

1. Client ↔ Service — TLS-encrypted gRPC/REST. Clients authenticate via bearer tokens. The service trusts the PDP for authorization.
2. Service ↔ PDP — If the PDP is compromised, authorization is compromised. The service fails closed if the PDP is unreachable.
3. Service ↔ Storage — Storage holds encrypted key handles and metadata. Key material lives in the provider, not storage.
4. Service ↔ HSM — The HSM is the root of trust. PKCS#11 PIN is zeroized after session establishment.

Security invariants

These invariants are enforced structurally in the codebase:

1. Authorization on every operation — Every handler passes through PDP authorization before executing.
2. Audit on every operation — Including denied requests (AuthorizationDenied).
3. Fail-closed on PDP unavailability — No “allow if PDP is down” mode.
4. Fail-closed on KMS unavailability — No fallback to weaker algorithms.
5. Sensitive data zeroization — Key material, plaintext, and DEKs use Sensitive<T> wrapper.
6. Identity tags excluded from responses — Only user_tags returned to API callers.
7. Opaque encryption context — AAD is BLAKE3-hashed in audit logs; raw values never persisted.
8. Cascade disable — Disabling a parent key disables all descendants server-side.
9. Unique LIDs — UUID injection makes LID collisions structurally impossible.
10. Constant-time authentication — Bootstrap token comparison uses constant-time equality.

Cryptography

Purpose	Algorithm
Symmetric encryption	AES-256-GCM
Signing	Ed25519, ECDSA P-256, RSA PKCS#1v1.5
Internal hashing	BLAKE3
Wire-boundary hashing	SHA-256

FIPS 140-3 compliance is achieved through the HSM provider path. The HSM’s certificate defines the cryptographic boundary.

Audit integrity

Audit events include Ed25519 signatures and BLAKE3 hash-chain linking. Events are delivered via NATS for durable, distributed consumption.

Vulnerability disclosure

Report security issues responsibly via the process documented in the upstream SECURITY.md.

Full reference

• SECURITY.md
• CRYPTO_SECURITY_MODEL.md
• COMPLIANCE_POSTURE.md

See also: Integration guide · Operator guide