HACKING PROJECT · crypto · Advanced
Cryptographic Key Management System
Deliver a full-lifecycle key management system that securely generates, stores, rotates, and audits cryptographic keys under least-privilege access control.
Cryptographic keys are the root of trust for encryption, signing, and blockchain wallets, yet organizations routinely mishandle them — hardcoding keys in source, storing them in plaintext, or failing to rotate and revoke them. A single leaked private key can compromise entire wallets, TLS estates, or signing infrastructure. The gap between generating keys and managing their full lifecycle (generation, storage, rotation, access control, revocation, audit) is where most real-world breaches occur.
**What you'll build**
Build an enterprise-grade Key Management System that centralizes secure key generation, envelope encryption, fine-grained access control, automated rotation, and tamper-evident audit logging, aligned with NIST 800-57 and backed by HSM/KMS integration. Support hierarchical keys (KEK/DEK), least-privilege policies, and short-lived credentials, exposing a hardened API for applications to request cryptographic operations without ever handling raw key material. Optionally integrate blockchain wallet key custody with threshold/MPC signing.
**Objective** — Deliver a full-lifecycle key management system that securely generates, stores, rotates, and audits cryptographic keys under least-privilege access control.
**Expected outcome** — A working KMS service with envelope encryption, policy-based access, automated rotation, audit logs, and an API/SDK — deployable against a software or cloud HSM backend.
**Difficulty** — Advanced — spans applied cryptography, secrets architecture, access control, and secure API design to production standards.
**Primary category** — IAM / Cryptographic Infrastructure; Secondary = Cloud Security, Data Protection, DevSecOps
**Security domains** — Primary = Cloud Security; Secondary = GRC, DevSecOps, Blue Team, AppSec
**Technical focus** — Key lifecycle management, envelope encryption (KEK/DEK), HSM/KMS integration, secrets management, RBAC/ABAC, key rotation & revocation, audit logging, MPC/threshold signing, PKI
**Core technologies** — Languages: Go, Python, Rust; Frameworks/Libraries: HashiCorp Vault, OpenSSL, libsodium, PKCS#11; Security Tools: AWS KMS/CloudHSM, Azure Key Vault, GCP KMS, SoftHSM; Cloud/Infra: Kubernetes, Docker, Terraform; AI/Data: anomaly detection on key-access logs (optional); Databases: PostgreSQL, encrypted metadata store
**Where it's valued** — Financial services, cloud providers, healthcare, government, crypto custody, any regulated enterprise handling encryption
**Careers it builds toward** — Cryptography/PKI Engineer, Cloud Security Engineer, IAM Engineer, Security Architect, DevSecOps Engineer
**Framework alignment**
• MITRE ATT&CK: Defends against Credentials from Password Stores (T1555), Unsecured Credentials (T1552), Steal Application Access Token (T1528); mitigates Data Encrypted for Impact (T1486) key exposure.
• NIST CSF 2.0: Protect (access control, data security, cryptography), Govern (policy), Identify, Detect (access anomaly)
• OWASP: Cryptographic Failures (A02), Identification & Authentication Failures (A07); API Security (broken auth)
• CIS Controls v8: 3 Data Protection, 5 Account Management, 6 Access Control Management, 8 Audit Log Management
**Innovation** — Enterprise Product — mature category (Vault, KMS) but a well-architected, HSM-backed system with MPC signing is highly employable and enterprise-ready. Scores: Innovation 6/10, Startup 7/10, Enterprise-Readiness 9/10, Patent = No.