Key architecture
How the group holds its own keys
The certificate authorities, the algorithms and the ceremony that stand behind every service the group operates.
A design note, not a certificate
Every statement here describes a design choice the group made and can demonstrate. None describes an audit it has not passed.
Authorities
One offline root, two working authorities
The root signs almost nothing. What signs daily is subordinate to it, and scoped.
- The root stays offlineIt signs only its subordinates. A root that signs daily work is a root that lives on a reachable machine.
- One authority for the supply chainIt signs build artefacts and their attestations. It never issues an identity to a running service.
- One authority for workloadsIt issues the identities services present to each other. It never signs anything shipped to a customer.
Algorithms
What the group signs and exchanges with
Elliptic curves for signature, a hybrid exchange for confidentiality, and a legacy family being retired.
- SignatureECDSA P-384 for servers and service-to-service authentication. Ed25519 for the root and for operator access.
- Key exchangeA hybrid of X25519 and ML-KEM-768. Traffic captured today stays confidential against a future quantum adversary.
- What is being retiredRSA-3072 remains only where a counterparty requires it, and is tracked for removal.
Lifetimes
Short by design
A credential that lives for months is a credential nobody notices leaving.
- Workload identitiesIssued for minutes, not days, and renewed automatically. A stolen one is worthless before it can be used.
- Operator accessEach session is opened with a certificate issued for that session and recorded. No standing key sits on a laptop.
- Public certificatesIssued by a publicly trusted authority and renewed a month before term, because browsers must trust them.
Ceremony
No single person can use the root
Root operations require a quorum of holders, in person, against a written script.
A quorum removes the single point of compromise, and of coercion. Every root operation becomes a dated, witnessed event.
References
What the design is aligned on
These are the texts the architecture is built against. The group holds no certification under any of them.
- ISO/IEC 27001 § 8.24
- NIST SP 800-57
- NIST FIPS 203 (ML-KEM)
- CNSA 2.0
- RFC 8446 (TLS 1.3)
- RFC 9334 (RATS)
Ask for the detail under agreement
Architecture diagrams, key inventories and ceremony records are shared with customers under a confidentiality agreement.