Secrets Management & Cryptography
Relevant source files
The following files were used as context for generating this wiki page:
- TAMV-DEPLOYMENT-PREREQUISITES.md
- TAMV-MASTER-DOCUMENTATION.md
- ARCHIVE/tamv-docs-consolidated-2026-02-02/TAMV-OFFICIAL-SYSTEM-DESCRIPTION.md
- ARCHIVE/remaining-docs-consolidated-2026-02-13/IMPLEMENTATION-PROGRESS-REPORT.md
- ARCHIVE/readme-files-consolidated-2026-02-02/TAMV-FINAL-PRODUCTION-READY-README.md
Secrets Management and Cryptography within the TAMV (Territorio Autónomo de Memoria Viva) ecosystem are foundational components of its TENOCHTITLAN security framework. The system is designed under the principle of "Adaptive Adversarial Containment," utilizing post-quantum cryptographic standards and rigorous secret handling to ensure digital sovereignty and data integrity for all participants.
Sources: TAMV-MASTER-DOCUMENTATION.md:329-335, TAMV-OFFICIAL-SYSTEM-DESCRIPTION.md:35-37
The scope of this system covers the protection of user identities, financial transactions, and medical records through multiple layers of encryption (Aztek Gods Protocol) and decentralized storage solutions like the MSR (Memory, Sovereignty, Responsibility) blockchain.
Sources: TAMV-MASTER-DOCUMENTATION.md:337-340, TAMV-MASTER-DOCUMENTATION.md:162-168
Cryptographic Architecture
The TAMV ecosystem employs a multi-layered cryptographic approach categorized by functional layers. It transitionally moves from standard encryption to post-quantum resistant algorithms to mitigate future computational threats.
Post-Quantum Cryptography (PQC)
The system has implemented specialized PQC algorithms to protect long-term civilizational data.
- ML-KEM/ML-DSA: Primary implementation for key encapsulation and digital signatures.
- Adaptive Key Management: A context-based lifecycle for cryptographic keys that evolves based on the perceived threat environment.
- Zero-Knowledge Protocols: Used for privacy-preserving verification where users can prove claims (civilization registry) without revealing underlying sensitive data.
Sources: TAMV-OFFICIAL-SYSTEM-DESCRIPTION.md:42-45, TAMV-MASTER-DOCUMENTATION.md:351-354
The TENOCHTITLAN Defensive System
The defense mechanism is organized into four distinct entities, each providing escalating levels of cryptographic verification:
| System | Encryption Layers | Purpose |
|---|---|---|
| ANUBIS CENTINEL | 4 Layers | Primary system security and initial encryption. |
| HORUS CENTINEL | 6+2+2 Layers | Evolutionary standby for threat detection. |
| DEKATEOTL | 11 Layers | Supreme orchestration and verification. |
| AZTEK GODS | 22 Layers | Absolute standby for system continuity. |
Sources: TAMV-MASTER-DOCUMENTATION.md:337-344, TAMV-FINAL-PRODUCTION-READY-README.md:92-97
Secrets Management Strategy
The project mandates a strict "Never Commit Secrets" policy, utilizing enterprise-grade vaulting solutions for production environments.
Storage and Vaulting
TAMV prioritizes AWS Secrets Manager as the primary source of truth for sensitive credentials. This replaces insecure practices such as hardcoded strings or plain-text environment files in production.
The diagram shows the hierarchy of secret retrieval, prioritizing AWS Secrets Manager for production environments.
Sources: TAMV-DEPLOYMENT-PREREQUISITES.md:126-134, TAMV-FINAL-PRODUCTION-READY-README.md:14-20
Critical Secret Categories
The system identifies several categories of secrets required for deployment:
- JWT Secrets: 256-bit keys generated via OpenSSL (e.g.,
JWT_SECRET,JWT_REFRESH_SECRET). - Database Credentials: Passwords for PostgreSQL (RDS) and Redis (ElastiCache) requiring at least 24 characters with mandatory rotation every 90 days.
- Encryption Keys: 64-character hex keys used for AES-256-GCM encryption of sensitive user data.
- External API Keys: Credentials for Stripe (Payments), SendGrid (Email), and Twilio (SMS).
Sources: TAMV-DEPLOYMENT-PREREQUISITES.md:65-115
Cryptographic Lifecycle and Implementation
Cryptographic operations are integrated into the backend services to ensure data is sanitized and encrypted before persistence.
Data Flow for Secure Persistence
Sequence of encryption and validation during a secure data write operation.
Sources: IMPLEMENTATION-PROGRESS-REPORT.md:46-75, IMPLEMENTATION-PROGRESS-REPORT.md:130-145
Security Configuration Parameters
The following parameters are implemented in the production environment variables to control cryptographic and security behavior:
| Variable | Recommended Value / Source | Description |
|---|---|---|
ENCRYPTION_KEY | openssl rand -hex 32 | Key for symmetric data encryption. |
ENCRYPTION_ALGORITHM | aes-256-gcm | Standard for sensitive data at rest. |
BCRYPT_ROUNDS | 12 | Hashing rounds for user passwords. |
JWT_SECRET | AWS Secrets Manager | Secret for signing access tokens. |
REDIS_TLS_ENABLED | true | Enforces encryption in transit for cache. |
Sources: TAMV-DEPLOYMENT-PREREQUISITES.md:111-115, TAMV-MASTER-DOCUMENTATION.md:374-388
System Integrity and Auditing
TAMV uses the BookPI and MSR Chain to create an immutable registry of security events. Every significant cryptographic action or secret access is registered with a Merkle State Root (MSR) to ensure accountability.
Security Metrics
The effectiveness of the cryptographic and secrets management system is measured against specific benchmarks:
- Detection Time: Under 2 seconds for unauthorized access attempts.
- False Positive Rate: Less than 1%.
- Availability: Target of 99.9% with failover procedures.
Sources: TAMV-OFFICIAL-SYSTEM-DESCRIPTION.md:50-54, TAMV-MASTER-DOCUMENTATION.md:356-360
Conclusion
Secrets Management and Cryptography in TAMV are not merely utility layers but are deeply integrated into the "Adaptive Adversarial Containment Environment" (AACE). By combining AWS-managed vaulting for operational secrets with post-quantum algorithms for data persistence, the system establishes a "military-grade" security posture designed to survive both traditional and future cryptographic threats.
Sources: TAMV-FINAL-PRODUCTION-READY-README.md:1-10, TAMV-OFFICIAL-SYSTEM-DESCRIPTION.md:39-41