AMARACUS Architecture
How a request travels through AMARACUS: from your application, through the policy check and key store, to the cryptographic operation and its audit record.
Request Lifecycle Flow
Every operation goes through the same steps: authentication, a policy check, algorithm routing and an audit record.
Client Application
Invokes AMARACUS SDK using scoped API credentials over mutual TLS.
API Gateway & Auth
Authenticates request ID, validates organization context and environment permissions.
Policy Evaluation
Verifies whether requested key and algorithm satisfy organizational compliance rules.
Cryptographic Router
Resolves target algorithm and routes to the appropriate provider (KMS, HSM, or native software).
Cryptographic Execution
Performs operation (AES, Ed25519, ML-KEM-768) within isolated hardware or secure memory.
Tamper-Evident Audit
Logs operation metadata, actor, latency, and status to the immutable audit plane.
Control Plane
Governance & Declarative Compliance
The control plane is where policy lives. Engineers don't hardcode cipher suites; policies set which algorithms each environment may use.
- • Restricts policies to NIST-approved algorithms (AMARACUS is not a FIPS 140-3 validated module)
- • Flags deprecated cryptographic primitives (e.g. RSA-1024, SHA-1)
- • Workflows designed to move between algorithm versions without planned downtime
Key Plane
Custody, Lifecycle & KMS Federation
The key plane hides the physical storage underneath. Envelope encryption is the default, so keys never exist in plaintext memory on application servers.
- • Integrations with Azure Key Vault and Azure Key Vault Managed HSM
- • Automated rotation schedules and version tracking
- • Complete isolation between tenant environments
Execution Plane
Post-Quantum & Classical Primitives
Native execution core built for zeroization and timing-attack resistance. Supports modern classical algorithms and NIST standardized PQC algorithms.
- • ML-KEM (Module-Lattice Key Encapsulation Mechanism)
- • ML-DSA (Module-Lattice Digital Signature Algorithm)
- • Hardware-accelerated AES-GCM and ChaCha20-Poly1305
Audit Plane
CBOM & Cryptographic Inventory
Produces a Cryptographic Bill of Materials (CBOM), so security teams can see every active key and algorithm in real time.
- • Tamper-evident audit logs with request correlation
- • Automated readiness scoring for quantum computing threats
- • Exportable compliance reports for regulatory audits