Key Management System
Hardware Security Module (HSM) with TRNG and Hierarchical KDF
Tamper-resistant hardware security module storing master keys, deriving session keys via NIST SP 800-108 KDF, generating fresh entropy from a true random number generator (TRNG), and providing key rotation and revocation services.
Purpose
Provide a single root-of-trust for all Ark cryptographic operations, isolated from general-purpose compute and resistant to radiation, physical tampering, and software exploits; protect long-term keys for 100 years.
Context
Hardware companion to L3-COM-CRYPT-ENC (consumes session keys), L3-COM-CRYPT-AUTH (uses signing keys), and L3-COM-CRYPT-PROT (SDLS Security Association keys). Implements CCSDS SDLS-EP key management features.
Principles
- ▸Hierarchical key derivation: a long-term master key derives shorter-term session keys via a Key Derivation Function (KDF) like HKDF (RFC 5869)
- ▸True random number generation requires a physical entropy source (thermal noise, shot noise, ring oscillator metastability) — feeds CSPRNG for key generation
- ▸Key compartmentalization: separate keys for command uplink, telemetry downlink, mesh, payload encryption — limits damage from a single key compromise
- ▸Forward secrecy: session keys are ephemeral and discarded; even if long-term keys later compromised, past sessions remain confidential
- ▸Key rotation cadence balances cryptanalytic resistance vs. operational complexity; typical: command keys rotate monthly, payload keys rotate per session
- ▸Tamper-evident enclosure with active mesh sensors detects physical attack and triggers key zeroization
Typical implementations
- ▸Microchip ATECC608 / Trust Anchor — small-form secure enclaves with TRNG
- ▸Spacecraft TPM equivalents (Maxar/SEAKR rad-hard HSMs)
- ▸CCSDS 355.0-B SDLS-EP Key Management Service
- ▸NIST FIPS 140-3 Level 3/4 certified HSMs (terrestrial equivalents)
- ▸ESA Cryptographic Devices for SmallSats (Cryptolib)
- ▸PKCS#11 / KMIP interfaces for key services
Lunar considerations
- ▸Radiation can corrupt stored keys — use ECC memory and redundant storage with periodic integrity checks
- ▸Key zeroization on detected anomaly must be balanced against accidental zeroization from SEU
- ▸100-year mission likely outlives any specific HSM hardware — keys must be migratable via secure transfer protocol
- ▸Earth-bound key escrow: a master root key may be held on Earth for emergency commanding override, but local HSM operates independently
- ▸Long-term entropy reseeding: ensure TRNG continues functioning after decades; degradation mode to fall back to extended-state CSPRNG
Specifications
Functional
| primary function | Generate, store, derive, rotate, and revoke cryptographic keys |
| inputs | Key establishment requests from L3-COM-CRYPT-ENC, Authenticated key rotation commands from L3-COM-CRYPT-AUTH, Entropy from TRNG hardware, Tamper sensor signals |
| outputs | Session keys to L3-COM-CRYPT-ENC, Derived authentication keys to L3-COM-CRYPT-AUTH, Key usage logs (encrypted), Tamper / anomaly alerts |
| master keys supported | 8 |
| concurrent sessions | 64 |
| key sizes bits | 256, 384, 521, 768, 1024 |
| kdf algorithm | HKDF-SHA-384 / NIST SP 800-108 |
| trng min entropy per bit | 0.95 |
| trng throughput kbps min | 100 |
| tamper response time ms | 10 |
| fips certification target | FIPS 140-3 Level 3 equivalent |
Physical
| mass kg | 0.4 |
| dimensions | 100 × 80 × 25 mm secure enclosure |
| materials | Active mesh tamper-detection grid, Epoxy-potted secure die, Rad-tolerant secure element ASIC, Battery-backed SRAM for ephemeral keys (zeroizable), MRAM for long-term key storage (radiation-tolerant) |
| operating temperature c | -40, 70 |
| radiation tid krad | 50 |
Operational
| power consumption w | 1.5 |
| power consumption w standby | 0.1 |
| thermal range c | -40, 70 |
| lifetime years | 25 |
| mtbf hours | 300000 |
Interfaces
Provides
- Session keys and key schedules
- Signing/verification keys
- SDLS Security Association keys
Requires
- Always-on 3.3 V supply with battery backup for ephemeral state
- Authenticated commands for key rotation
Cite this entry
Lunar Ark Codex. "Key Management System" (L3-COM-CRYPT-KEY). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-COM-CRYPT-KEY
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.