papers/hanzo-digital-securities-integration/sections/05-mpc-custody-via-hanzo-kms.tex

\section{MPC Custody via Hanzo KMS}

\label{sec:custody}
% ============================================================================

MPC key material is managed through Hanzo KMS (kms.hanzo.ai):

\subsection{Key Hierarchy}

\begin{enumerate}[leftmargin=1.4em]
    \item \textbf{KMS Master Key}: Root encryption key managed by Hanzo
    KMS. Never exported.
    \item \textbf{MPC Share Encryption Keys}: Per-share-holder encryption
    keys derived from the KMS master key via envelope encryption.
    \item \textbf{MPC Key Shares}: The actual CGGMP21 key shares,
    encrypted at rest with their respective share encryption keys.
\end{enumerate}

\subsection{Operational Flow}

\begin{enumerate}[leftmargin=1.4em]
    \item \textbf{DKG}: During distributed key generation, each MPC
    node requests a share encryption key from KMS. The generated key
    share is immediately encrypted and stored.
    \item \textbf{Signing}: When a signing session begins, the MPC node
    requests decryption of its key share from KMS. KMS validates the
    request against IAM identity and returns the decrypted share. The
    share exists in memory only during the signing session.
    \item \textbf{Rotation}: During key resharing, new shares are
    encrypted with fresh KMS-derived keys. Old encrypted shares are
    securely deleted.
    \item \textbf{Audit}: Every KMS access is logged: who requested
    what key, when, and for what purpose.
\end{enumerate}

% ============================================================================