govoplan-encryption/docs/ENCRYPTION_BOUNDARY.md

Encryption Boundary

Purpose

govoplan-encryption is an optional cryptographic service module. It supplies key and content-protection capabilities to modules that choose to use them. It does not own feature data, normal authorization, retention, or business ownership.

Initial Invariants

1. Resource ownership and cryptographic key custody are independent.
2. Administrative ownership recovery does not grant encryption keys.
3. Key recovery is a separate, high-assurance, auditable ceremony.
4. Every ciphertext carries a stable protection profile, key version, algorithm suite, and authenticated context reference.
5. Rotation and rewrapping are resumable and idempotent.
6. Protected content cannot silently fall back to plaintext.
7. Provider loss, disabled modules, unavailable devices, and recovery delay are visible states, not generic read failures.
8. Disabling or uninstalling is blocked while unresolved protected content remains.

Planned Capability Families

• Key vault: create and resolve key hierarchies without exposing raw key material to feature modules.
• Content protection: authenticated envelope encryption and decryption for authorized feature-owned payloads.
• E2EE profiles: recipient/device key envelopes where the server cannot decrypt normal content.
• Rotation: rewrap keys and migrate algorithm suites with bounded progress and evidence.
• Recovery ceremony: quorum, delay, recent authentication, custody evidence, and explicit scope.
• Disable preflight: inventory protection references and produce a blocking migration plan.

Decisions Deferred Until Threat Modeling

• cryptographic libraries and external KMS/HSM providers
• server-managed versus client-managed profile suites
• per-object, per-vault, and per-recipient data-key granularity
• device enrollment and revocation protocol
• external-recipient key discovery and trust
• recovery quorum defaults for each assurance profile
• ciphertext portability and offline export format

These decisions require explicit threat models and interoperability fixtures. They must not be inferred from ordinary resource-ownership workflows.