Encryption Standards & Cryptographic Policy

1. Overview & Scope

Aevum Zenth operates a zero-trust security architecture across 62 countries. All data at rest, in transit, and in use must adhere to this cryptographic baseline. Deviations require written approval from the Office of the Chief Information Security Officer (OCISO) and must be logged in the central KMS audit trail.

This standard applies to:

• Core corporate infrastructure and cloud environments (AWS, Azure, GCP, Zenth Private Cloud)
• All subsidiary networks, including aerospace, healthcare, energy, and financial divisions
• Third-party vendor integrations and API gateways
• Edge devices, IoT telemetry streams, and autonomous systems

2. Approved Cryptographic Algorithms

Only NIST-approved and industry-validated algorithms are permitted. Legacy ciphers (DES, RC4, MD5, SHA-1, RSA < 2048) are strictly prohibited.

allowed_ciphers = [
  "TLS_AES_256_GCM_SHA384",
  "TLS_CHACHA20_POLY1305_SHA256",
  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
  "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
]
min_protocol_version = "TLSv1.3"
cert_pin_enforcement = true
ocsp_stapling = required

3. Data Classification & Encryption Tiers

Encryption strength is dictated by data sensitivity. All assets must be tagged with a classification level upon creation.

4. Key Management Infrastructure (KMI)

Key lifecycle management is centralized under Aevum Zenth KMS. Decentralized key generation is prohibited without OCISO authorization.

4.1 Hardware Security Modules

All T3–T5 encryption keys must be generated and stored in FIPS 140-3 Level 3 or higher certified HSMs. Approved vendors include YubiHSM 2, AWS CloudHSM, Azure Dedicated HSM, and Thales Luna 7.

4.2 Envelope Encryption Pattern

For high-volume data encryption, implement envelope encryption to balance performance and security:

1. Generate a data encryption key (DEK) locally in memory
2. Encrypt the DEK using a key encryption key (KEK) stored in HSM/KMS
3. Store encrypted DEK alongside ciphertext
4. Decrypt DEK on-demand via KMS API; never persist plaintext DEK to disk

// 1. Generate ephemeral DEK
dek = crypto.getRandomValues(new Uint8Array(32))
// 2. Encrypt DEK with KEK from HSM
encrypted_dek = KMS.encrypt(kek_id, dek)
// 3. Encrypt payload
ct = AES_GCM.encrypt(dk, plaintext, aad)
// 4. Store: { ct, encrypted_dek, algorithm, iv, tag }
// 5. On read: dek = KMS.decrypt(kek_id, encrypted_dek) -> AES_GCM.decrypt(dk, ct)

5. Compliance & Certifications

Aevum Zenth's cryptographic implementation is validated against international standards and regulatory frameworks.

6. Implementation Guidelines

Engineering teams must follow these directives when integrating cryptographic primitives into new or legacy systems:

• Never roll your own crypto. Use vetted libraries only: OpenSSL 3.x+, Bouncy Castle, libsodium, or cloud provider KMS/Keyless APIs.
• Enforce TLS 1.3 across all internal and external endpoints. HTTP/2 and HTTP/3 are preferred.
• Validate authenticity using detached signatures or authenticated encryption (AEAD). Never use ECB or CBC without proper padding oracle protections.
• Secure enclaves: Leverage AWS Nitro Enclaves, Azure confidential computing, or Intel SGX/AMD SEV for in-use encryption where applicable.
• API Security: All REST/gRPC endpoints must implement mutual TLS (mTLS) or OAuth 2.0 / OIDC with DPoP proof tokens.

7. Key Rotation & Incident Response

7.1 Rotation Policy

• Symmetric DEKs: Rotate every 90 days or after 10,000 encrypt/decrypt operations
• Asymmetric KEKs: Rotate annually or upon compromise suspicion
• TLS Certificates: Valid for maximum 90 days. Automated via ACME/Let's Encrypt or internal PKI
• Session Keys: Destroyed upon connection termination or user logout

7.2 Incident Response Protocols

In the event of suspected key compromise or cryptographic weakness discovery:

1. Isolate affected systems immediately via network segmentation
2. Revoke compromised keys in KMS and distribute CRL/OCSP updates
3. Generate fresh KEK/DEK pairs using approved RNGs
4. Re-encrypt affected datasets using the new KEK
5. File an incident report with OCISO and initiate forensic audit