Skip to content

Secrets and Key Custody Architecture

Why this chapter matters

Keys and secrets are concentrated responsibility. This chapter keeps custody attributable, minimal, revocable, and recoverable, while making clear that cryptographic control authenticates a bounded act rather than creating the Architect or the authority behind the act.

Continue to Secure Build and Supply-Chain Architecture to follow trust into the software that carries it.

Defines boundaries for secret material, key custody, use, rotation, compromise, recovery, and evidence.

  • INFRA8-R001: Secret material SHALL remain isolated from source, logs, prompts, public documents, ordinary workloads, and generated summaries.
  • INFRA8-R002: Key use SHALL identify purpose, authorised actor, scope, custody event, expiry, and revocation state.
  • INFRA8-R003: Suspected compromise SHALL trigger bounded containment, evidence preservation, revocation review, and recovery without assuming trust.
  • INFRA8-R004: Technical possession of key material SHALL not create authority or consent.
  • INFRA8-R005: Custody design SHALL record purpose, owner, separation of duties, authorised use, quorum, rotation, backup, recovery, revocation, and destruction evidence.
  • INFRA8-R006: Exposure, suspected compromise, unavailable custodian, or ambiguous ownership SHALL trigger containment and preserve evidence before trust is restored.
  • INFRA8-R007: Recovery SHALL not use the compromised or unavailable authority as its sole proof of legitimacy.
  • INFRA8-R008: A custody design SHALL NOT generate, import, expose, or use live secrets or keys; it remains conceptual.

This Draft creates no keys and configures no signer.

Custody method

Custody design shall identify generation or import, authorised use, quorum or separation requirements, rotation, backup, recovery, revocation, destruction, and evidence. Secret exposure shall be treated as a potential compromise even when misuse is not observed.

Failure cases

Unlogged use, copied secrets, weak recovery, unavailable custodian, replay, ambiguous ownership, and incomplete destruction evidence shall block dependent trust until reviewed.

Operating model and evidence

Key custody separates generation or import, storage, authorised use, rotation, backup, recovery, revocation, and destruction. Each step has an accountable owner, purpose, evidence state, and independent challenge where consequence requires it. Secret-like material is minimised in records and never reproduced in public or ordinary operational context.

Reviewers test copied secrets, unlogged use, replay, weak recovery, unavailable custodians, ambiguous ownership, incomplete destruction, and compromise response. A key can be technically usable while its authority or custody evidence remains insufficient; dependent trust pauses until the gap is resolved.

Interpretation cases

  • Conforming: Purpose, custody, separation, authorised use, rotation, recovery, revocation, and destruction are evidenced.
  • Prohibited: Possession or successful cryptographic use creates authority.
  • Boundary: Suspected exposure causes quarantine and a bounded recovery path.
  • Failure: Unavailable custodian or incomplete destruction preserves uncertainty and blocks trust.
  • Loophole: Emergency recovery bypasses independent evidence or scope limits.
  • Misuse: Secret material or custody data enters public records or unrelated logs.
  • Care-control: Recovery protects continuity while preserving consent, privacy, and accountable review.

Design evidence

Custody review should show separation of duties, authorised purposes, quorum or equivalent control, exposure response, rotation, revocation, backup, recovery, and destruction evidence without reproducing secret material. Missing custody evidence is not proof that a secret was unused.