mhtirogla
Home
Systems
API
Pricing
About
Log in
← Back
Home
›
Systems
›
Security and identity
hsm-service
hardware security module service
CloudHSM
System
Techniques · 5
Primitives · 25
hsm-service
Raft
distributed · medium: Leader-based consensus on a replicated log; one leader per term, majority commit; the default for a strongly consistent replicated state machine.
›
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Hardware security module (HSM)
security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.
›
Tamper-evident audit log
security · medium: An append-only log whose Merkle root, signed per batch, lets anyone verify an entry is present and history was never rewritten, with log-size proofs.
›
State-machine snapshots
distributed · medium: Periodically save the state a log has produced at index i so the log prefix can be deleted; recovery and catch-up become load snapshot plus replay suffix.
›
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Secure memory zeroization
security · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.
›
Digital signatures (Ed25519)
security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
ECDSA signatures
security · low: The elliptic-curve signature standardised in FIPS 186-5 (P-256) and used by secp256k1 ledgers; 64-byte signatures, but a repeated or biased nonce leaks the private key.
›
Microarchitectural side channels
security · low: Cache timing (Prime+Probe, Flush+Reload) and speculative-execution (Spectre, Meltdown) leaks and their mitigations
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
Rsa cryptosystem
security · low: RSA key generation, OAEP encryption and PSS/PKCS#1 v1.5 signatures, key sizes and padding pitfalls
Shamir secret sharing (k-of-n)
security · low: Split a secret into n shares so any k reconstruct it and any k-1 reveal nothing at all, using a random polynomial over a finite field.
›
Leases
distributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.
›
Write-ahead log
storage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.
›
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
Dual control approval
security · low: Four-eyes / maker-checker approval with quorum policies for sensitive operations
Merkle tree
data-structures · low: Hash tree for verifying and diffing large datasets with logarithmic proofs
+ 9 more primitives
System
Techniques · 5
Primitives · 25
hsm-service
Raft
distributed · medium: Leader-based consensus on a replicated log; one leader per term, majority commit; the default for a strongly consistent replicated state machine.
›
Envelope encryption
security · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.
›
Hardware security module (HSM)
security · medium: A tamper-resistant device or service that generates keys, signs, decrypts and wraps with them internally, and releases a key only as ciphertext.
›
Tamper-evident audit log
security · medium: An append-only log whose Merkle root, signed per batch, lets anyone verify an entry is present and history was never rewritten, with log-size proofs.
›
State-machine snapshots
distributed · medium: Periodically save the state a log has produced at index i so the log prefix can be deleted; recovery and catch-up become load snapshot plus replay suffix.
›
AEAD (AES-GCM, ChaCha20-Poly1305)
security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.
›
Aes key wrap
security · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key material
Csprng
security · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enough
Secure memory zeroization
security · low: Keep secrets in one locked, fixed-size, non-copyable region, erase them with writes the compiler must keep, and exclude them from dumps and swap.
›
Digital signatures (Ed25519)
security · low: Small, fast, deterministic public-key signatures that prove who produced a message; the default for tokens, releases and protocols.
›
Constant time code
security · low: Writing secret-dependent code without branches or memory lookups on secrets; constant-time compare and select
ECDSA signatures
security · low: The elliptic-curve signature standardised in FIPS 186-5 (P-256) and used by secp256k1 ledgers; 64-byte signatures, but a repeated or biased nonce leaks the private key.
›
Microarchitectural side channels
security · low: Cache timing (Prime+Probe, Flush+Reload) and speculative-execution (Spectre, Meltdown) leaks and their mitigations
Mutual TLS
security · low: TLS where the client also proves a certificate key, so every connection carries a verified, rotatable machine identity.
›
Rsa cryptosystem
security · low: RSA key generation, OAEP encryption and PSS/PKCS#1 v1.5 signatures, key sizes and padding pitfalls
Shamir secret sharing (k-of-n)
security · low: Split a secret into n shares so any k reconstruct it and any k-1 reveal nothing at all, using a random polynomial over a finite field.
›
Leases
distributed · low: A lock that expires on its own: bounded-time ownership that survives crashes and partitions, given bounded clock drift and fencing tokens on writes.
›
Write-ahead log
storage · low: Append each change to a checksummed sequential log and fsync it before touching data pages; the basis of crash durability in nearly every database.
›
Exponential backoff with jitter
systems · low: Retry after delays that grow geometrically and are randomized, so failed clients spread out instead of hammering a recovering service in synchronized waves.
›
Dual control approval
security · low: Four-eyes / maker-checker approval with quorum policies for sensitive operations
Merkle tree
data-structures · low: Hash tree for verifying and diffing large datasets with logarithmic proofs
Segmented log
distributed · low: Split an append-only log into files named by their first offset, write only the newest, and find any record by binary search plus a sparse index.
›
Trusted timestamping
security · low: RFC 3161 time-stamp tokens: a TSA signs a hash with time, proving data existed then
Copy-on-write fork
hardware-os · low: fork() gives the child the parent's whole address space by sharing pages read-only and copying one only when someone writes it; vfork and posix_spawn skip even that.
›
Copy on write snapshots
storage · low: Point-in-time snapshots by sharing pages/extents and copying only on write
Fencing tokens
distributed · low: A number that grows with every lock grant and is checked by the protected resource, so a paused ex-holder's late write is rejected.
›
CRC32C checksums
hardware-os · low: The Castagnoli CRC-32 with dedicated instructions on x86 (SSE4.2) and ARMv8. It is the standard fast integrity check for storage blocks, logs and network frames.
›
fsync, O_DSYNC and O_DIRECT
hardware-os · low: What fsync, fdatasync, O_DSYNC, O_DIRECT and F_FULLFSYNC really guarantee on Linux and macOS, and the exact call sequences for crash-safe files.
›
SIMD programming
hardware-os · low: Process 4-16 lanes per instruction with AVX2, AVX-512 or NEON via Rust std::arch, with runtime dispatch and a portable fallback.
›
PRNGs (PCG, xoshiro)
numerics · low: Small, fast, statistically strong non-cryptographic generators: PCG32 and xoshiro256**, with seeding, parallel streams and unbiased ranges.
›
Copy for AI
Similar systems
Share the most building blocks with this one.
secrets-kms
39 %
custody-wallet
24 %
card-vault
23 %
digital-wallet
20 %
pki
19 %