| Alias | Algorithm | Purpose | Partition | Created | Rotation due | Quorum | State | |
|---|---|---|---|---|---|---|---|---|
| afcos-db-kek-2026 | AES-256-GCM | Key-encryption key | DC1 · prod-general | 2026-01-15 | 2027-01-15 | 2 of 3 | Active | |
| goaml-sign-2026 | ECDSA P-384 | Signing | DC1 · goaml-signing | 2026-03-01 | 2026-11-30 | 2 of 3 | Rotate soon | |
| wb-seal-root | AES-256-GCM | Key-encryption key | DC1 · prod-general | 2025-07-01 | 2026-11-14 | 3 of 5 | Rotate soon | |
| tls-edge-2026 | Hybrid X25519 + ML-KEM-768 | TLS | DC1 · prod-general | 2026-05-10 | 2027-05-10 | 1 of 3 | Active | |
| ro-api-mtls-ca | RSA-3072 | Signing | DC1 · pki-issuing | 2024-02-01 | 2027-02-01 | 2 of 3 | Quantum-vulnerable | |
| grc-backup-2024 | AES-256-GCM | Backup encryption | DR · prod-general | 2024-01-10 | 2025-01-10 | 2 of 3 | Deactivated | |
| pqc-sign-pilot | ML-DSA-65 (FIPS 204) | Signing | DC1 · goaml-signing | 2026-09-02 | 2027-09-02 | 2 of 3 | Active |
life_used = max( age / cryptoperiod , operations / op_limit ) rotate when life_used ≥ 0.9 or compromise suspected AES-GCM op_limit = 2^32 encryptions per key (random 96-bit nonces) states (NIST SP 800-57): pre-activation → active → suspended → deactivated → compromised | destroyed