Sovereign Key Custody & HSM Integration (BYOK)

To satisfy national cybersecurity mandates and zero-trust security postures, Aarkam enforces Absolute Sovereign Key Custody. Cloud service providers, hosting facilities, and Aarkam platform operators possess zero mathematical capability to decrypt customer datasets.

1. Bring Your Own Key (BYOK) Architecture

Aarkam integrates natively with industry-standard cryptographic hardware and protocols:

┌────────────────────────────────────────────────────────┐
│             Customer-Operated Hardware Vault           │
│        Thales Luna · Entrust · HashiCorp Vault · KMS   │
└───────────────────────────┬────────────────────────────┘
                            │ PKCS#11 / KMIP 2.1 Protocol
                            ▼
┌────────────────────────────────────────────────────────┐
│                   Aarkam Key Manager                   │
│   • Never stores unencrypted master keys               │
│   • Tracks KmsProvider & KmsArn metadata               │
│   • Executes envelope key wrapping in memory           │
└────────────────────────────────────────────────────────┘

• Protocols Supported: PKCS#11, OASIS KMIP 2.1, AWS KMS, HashiCorp Vault.
• Hardware Isolation: Master Key Encrypting Keys (KEKs) are generated and physically contained within FIPS 140-2/3 Level 3 validated hardware boundaries.
• Non-Exportable Keys: KEKs are marked non-exportable; wrapping and unwrapping of ephemeral Data Encryption Keys (DEKs) occurs inside the HSM crypto engine.

2. Automated 90-Day Key Rotation Lifecycle

In compliance with NCA ECC-2:2024 §2-8 and NIST SP 800-57, the EncryptionKey domain entity enforces automated key rotation:

public class EncryptionKey
{
    public Guid Id { get; private set; }
    public string KmsArn { get; private set; }
    public DateTime CreatedAtUtc { get; private set; }
    public DateTime? RotatedAtUtc { get; private set; }
    public int KeyVersion { get; private set; }

    public const int MaxLifespanDays = 90;

    public bool ShouldRotate() => 
        (DateTime.UtcNow - (RotatedAtUtc ?? CreatedAtUtc)).TotalDays >= MaxLifespanDays;

    public void Rotate(string newKmsArn)
    {
        RotatedAtUtc = DateTime.UtcNow;
        KeyVersion++;
        KmsArn = newKmsArn;
    }
}

• Re-encryption Without Plaintext Exposure: When a KEK rotates, existing object DEKs are re-wrapped under the new KEK version without decrypting underlying multi-petabyte payloads.
• Active Version Tracking: Objects retain their key version reference, enabling seamless decryption across historical key generations.

3. Cryptographic Shredding & Revocation

When an organization terminates an agreement or revokes authorization:

• Disabling the KEK inside the customer HSM instantly renders every petabyte of stored data mathematically irrecoverable across all storage nodes.
• Per-object cryptographic shredding permanently purges individual DEKs, satisfying GDPR Article 17 and SDAIA PDPL Article 4 without requiring slow physical drive degaussing.