51 lines
2.1 KiB
Markdown
51 lines
2.1 KiB
Markdown
# Encryption Boundary
|
|
|
|
## Purpose
|
|
|
|
`govoplan-encryption` is an optional cryptographic service module. It supplies
|
|
key and content-protection capabilities to modules that choose to use them. It
|
|
does not own feature data, normal authorization, retention, or business
|
|
ownership.
|
|
|
|
## Initial Invariants
|
|
|
|
1. Resource ownership and cryptographic key custody are independent.
|
|
2. Administrative ownership recovery does not grant encryption keys.
|
|
3. Key recovery is a separate, high-assurance, auditable ceremony.
|
|
4. Every ciphertext carries a stable protection profile, key version, algorithm
|
|
suite, and authenticated context reference.
|
|
5. Rotation and rewrapping are resumable and idempotent.
|
|
6. Protected content cannot silently fall back to plaintext.
|
|
7. Provider loss, disabled modules, unavailable devices, and recovery delay are
|
|
visible states, not generic read failures.
|
|
8. Disabling or uninstalling is blocked while unresolved protected content
|
|
remains.
|
|
|
|
## Planned Capability Families
|
|
|
|
- **Key vault:** create and resolve key hierarchies without exposing raw key
|
|
material to feature modules.
|
|
- **Content protection:** authenticated envelope encryption and decryption for
|
|
authorized feature-owned payloads.
|
|
- **E2EE profiles:** recipient/device key envelopes where the server cannot
|
|
decrypt normal content.
|
|
- **Rotation:** rewrap keys and migrate algorithm suites with bounded progress
|
|
and evidence.
|
|
- **Recovery ceremony:** quorum, delay, recent authentication, custody evidence,
|
|
and explicit scope.
|
|
- **Disable preflight:** inventory protection references and produce a blocking
|
|
migration plan.
|
|
|
|
## Decisions Deferred Until Threat Modeling
|
|
|
|
- cryptographic libraries and external KMS/HSM providers
|
|
- server-managed versus client-managed profile suites
|
|
- per-object, per-vault, and per-recipient data-key granularity
|
|
- device enrollment and revocation protocol
|
|
- external-recipient key discovery and trust
|
|
- recovery quorum defaults for each assurance profile
|
|
- ciphertext portability and offline export format
|
|
|
|
These decisions require explicit threat models and interoperability fixtures.
|
|
They must not be inferred from ordinary resource-ownership workflows.
|