Bengar Custody AVAILABLE
Self-hosted software custody. Not an HSM, and it says so.
What it is
- A separate service holding per-principal approval keys and per-organization chain signing keys, encrypted at rest under a KEK that is not in its database.
Why it exists
- A key held by the service that answers requests is a key an attacker gets with the request handler.
How it works
- Reachable only over mutual TLS from an allow-listed client.
- It accepts a semantic operation from a closed set and builds what it signs itself.
- Runs with a read-only root filesystem, no capabilities, no Docker socket and no published port.
Who uses it
- Operators running Bengar for an organization
Security boundary
- SOFTWARE CUSTODY, not an HSM. During one signing operation the key is in process memory.
- Custody down is not authorization down; it is reached only at the signing boundary.
- No caller can hand it bytes, a digest or a raw sign document — there is no field for one.
Example flow
A stolen volume
- An attacker copies the database volume.
- Every private key in it is ciphertext.
- The KEK is a mounted secret and is not in that volume.
- Without it the copy yields nothing usable.
Current status
| Capability | Status | Where |
|---|---|---|
| Provision or retire a Custody approval key | AVAILABLE | /projects/:id/security/approval-signing |