Signing Keys

ENTITY v3.4.2 uses Ed25519 in the reference identity vault with distinct operational signing and recovery roles. Private-key custody is a deployment security boundary.

Operational key

The active signing method is used for assertion, authentication and contract-style signatures. Signature records bind Entity ID, key ID, suite, signing time and payload SHA-256.

Recovery key

A separate recovery verification method is designated for recovery. Do not expose recovery material to ordinary applications or routine signing workflows.

Filesystem custody

The reference implementation writes private material under the Entity state directory and attempts restrictive permissions. Production deployments should add OS controls, encrypted storage and—where qualified—hardware-backed wrapping.

Hardware boundary

The runtime has a key-protector interface for hardware-wrapped private keys, but hardware-backed key custody remains a post-release promotion gate for v3.4.2.

Never publish

Private keys, recovery secrets, pairwise secrets, operational backups, live credentials or unredacted production state must not be committed to public repositories or attached to bug reports.