Cryptographic Controls Policy (A.8.24)

Document ID: cryptographic-controls-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

---

Purpose

Define which cryptographic algorithms, key sizes, and key management practices are approved for protecting SigmaShake information assets.

Approved algorithms

Use case	Algorithm	Key size / parameters	Notes
Evidence signing	Ed25519	256-bit (Curve25519)	IETF RFC 8032
TLS transport	TLS 1.3 only on the Worker hostnames (TLS 1.2 and older rejected); docs.sigmashake.com also accepts TLS 1.2	ECDHE preferred	Enforced by the Cloudflare edge. Measured 2026-10-11
HMAC (internal auth)	HMAC-SHA-256	256-bit key	Secrets Store or Worker secret, per key
Password hashing	PBKDF2-SHA256	100,000 iterations, per-user salt	sigmashake-sso stores a password hash for email/password registration
Content addressing	SHA-256	—	Evidence hashing + Merkle chain

Prohibited algorithms

• MD5, SHA-1 (for integrity or signing purposes)
• RSA < 2048 bits
• DES, 3DES, RC4
• ECB mode for any block cipher
• Self-signed TLS certificates in production

Key management

Evidence signing keys (Ed25519)

• Generated in Cloudflare Workers using crypto.subtle.generateKey
• Private key stored as COMPLIANCE_SIGNING_KEY in Cloudflare Secrets Store
• Public key registered in signing_keys table and published at /.well-known/compliance-pubkey
• Rotation target: every 90 days (manual; no rotation is recorded yet). An overlap slot (COMPLIANCE_SIGNING_KEY_V2) is the plan for the rotation window
• Retiring keys remain in signing_keys with state retiring so historical evidence remains verifiable

HMAC keys

• Anchor HMAC keys (COMPLIANCE_ANCHOR_HMAC_KEY) are in Cloudflare Secrets Store. The break-glass ingest key (EVIDENCE_BLOB_HMAC_KEY) is a Worker secret
• Rotation target is the same 90 days as for signing keys. The secrets-age and rotation-smoke collectors only measure secret age and smoke-test the secrets. They rotate nothing
• Never transmitted; compared via constant-time equality

GitHub App private key (RSA)

• RS256 JWT signing for GitHub App installation token minting
• Stored as the Worker secret GITHUB_APP_PRIVATE_KEY (set with wrangler secret put)
• Rotated annually or on suspected compromise

Transport security

All external-facing endpoints use HTTPS enforced by Cloudflare. Internal service-to-service calls use Cloudflare service bindings (same-network, TLS-equivalent isolation).

Key compromise response

If a signing key is suspected compromised:

1. Immediately set key state to revoked in signing_keys
2. Generate a new key and deploy as the active key
3. Issue an incident report referencing affected evidence objects
4. Notify affected auditors or customers if evidence integrity is in question

Evidence

Collector	Cadence	Control
secrets-age	Daily	A.5.17, A.8.24
rotation-smoke	Daily	A.5.17, A.8.24
saml-signing-attestation	Weekly	A.8.24
sso-signing-key-age	Weekly	A.8.24