Cryptographic key lifecycle (KMS), Hardware Security Modules (HSM) integration, and rotation strategies.

Key Management Lifecycle

ABS Core relies on asymmetric cryptography (Ed25519) and SHA-256 hashes to guarantee the integrity of the immutable ledger (Gate 09, LEDGER_COMMIT). Proper management of these keys is the central pillar of system sovereignty.

1. Hierarchy of Trust

The ABS Core key infrastructure is divided into three levels:

Root of Trust (RoT): The offline master key, used exclusively to sign infrastructure keys (Infrastructure Keys). It must be stored in a physical vault or offline HSM.
Infrastructure Keys: Cluster-level keys that sign the identity of each individual Node (Agent Keys) that joins the network.
Agent Keys: Ephemeral keys generated by each instance of the Agent Node. They are used to sign transactions and the intent history in the ledger.

2. Hardware Security Module (HSM) Integration

For institutional environments (Banking, Defense), Root and Infrastructure level keys must not reside on the file system.

ABS Core supports integration via PKCS#11 — implemented today in OID/src/key-provider-hsm.ts via the graphene-pk11 library, covering PKCS#11-compliant HSMs (e.g. Thales Luna, generic PKCS#11 tokens).

KMIP (Key Management Interoperability Protocol) is not implemented. There is no KMIP client anywhere in OID/ or elsewhere in the codebase. Treat AWS CloudHSM, Azure Key Vault, and Entrust nShield support as roadmap items, not shipped integrations, unless they expose a PKCS#11 interface you configure directly.

Configuration Example (PKCS#11)

security:
  hsm:
    enabled: true
    provider: "pkcs11"
    library: "/usr/safenet/lunaclient/lib/libCryptoki2_64.so"
    slot_id: 1
    pin_env: "HSM_PARTITION_PIN"

3. Key Rotation & Lifecycle

The lifecycle of Agent Keys is ephemeral by design to reduce the attack surface in case of node compromise.

Event	Action	Maximum RTO
Start-up	New Agent Key generated and signed by the Infrastructure Key.	N/A
Regular Rotation	The node rotates its key every 24 hours (configurable).	Zero downtime (Overlap)
Revocation (Compromise)	The Infrastructure Key publishes a CRL (Certificate Revocation List) on the network. The isolated node is immediately banned.	< 500ms

4. Disaster Recovery (Cryptographic)

The loss of the Root of Trust is a catastrophic event that invalidates the entire ABS Core trust chain.

Quorum Procedure (M-of-N): The Root Key must be generated using a Shamir secret sharing scheme (e.g., 3 out of 5 directors required to reconstruct the key).
Generation Ceremony: Must follow NIST SP 800-57 Part 1 Rev. 5 guidelines, conducted in an air-gapped environment and video audited.

Key Management & HSM Integration