Learn · TrustedAIGov® Enterprise Knowledge Platform
Informational Fresh jira_story: GOV-310

Lesson 1 of 3 — Real asymmetric signing with KMS

Cryptographic Trust & Anchoring · Source: Jira Story GOV-310 (13 pts) · Authority: Informational (the Jira story is authoritative).

Purpose

Sign artefacts with real asymmetric keys held in a KMS.

Why it matters

Real signatures (not placeholders) make evidence independently verifiable.

Where this lives

Runs in the Customer AI Governance platform (components: shared). A KMS holds keys; artefacts are signed with Ed25519/RSA; no key material lives in code. Learn teaches this read-only.

Workflow

  1. Given an artefact to sign
  2. When it is signed
  3. Then it carries an Ed25519 or RSA signature from a KMS with no hardcoded keys

Worked example

An artefact is 'signed' using a key checked into the repo. Why is that unacceptable here?

Keys must live in a KMS; a checked-in or hardcoded key can't be trusted, and this story forbids it.

Acceptance criteria (authoritative — GOV-310)

Given an artefact to sign, when it is signed, then it carries an Ed25519 or RSA signature from a KMS with no hardcoded keys.

Common pitfalls

  • Hardcoded keys or placeholder signatures that can't be trusted.

Knowledge check

  • Scenario: An artefact is 'signed' using a key checked into the repo. Why is that unacceptable here?
  • Look for: Keys must live in a KMS; a checked-in or hardcoded key can't be trusted, and this story forbids it.

Key concepts

  • asymmetric signing
  • KMS
  • no hardcoded keys

For the AI Tutor

  • Summary: Sign artefacts with real asymmetric keys held in a KMS.
  • When to use: teaching or answering questions about "real asymmetric signing with kms".
  • When NOT to use: the sha256 hashing of evidence uploads (that is GOV-132).
  • Key concepts: asymmetric signing, KMS, no hardcoded keys.

Completion criteria

Learner passes the scenario knowledge check and can point to the system state that satisfies GOV-310's acceptance criterion.

  • Module: LEARN-MOD-010 (Cryptographic Trust & Anchoring)
  • Provenance: LEARN-MAP-001 · Generation standard: LEARN-STD-002
  • Next: LEARN-LSN-052
Next →