> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/remote-key-storage/architecture-and-components.md).

# Architecture and Components

```
         ASP application
               │  (enrolment redirect / Esign XML / EsignStatus)
               ▼
   ┌────────────────────────── eMudhra ESP ──────────────────────────┐
   │  Key Management Server (KMS)  ──►  KYC provider (eKYC account)   │
   │         │  AI (Authentication Interface)                         │
   │         │  CHI (CA-HSM Interface)  ──►  eMudhra CA                │
   │         │  SHI (Signing-HSM Interface)                           │
   │         ▼                                                        │
   │  ┌──────────────── HSM boundary (FIPS 140-3 L3) ──────────────┐  │
   │  │  SAM — Subscriber Authentication Module                    │  │
   │  │    • AuthPIN verification material (non-recoverable)       │  │
   │  │    • retry counters & lockout                              │  │
   │  │    • session-token issue & validation                      │  │
   │  │  Subscriber private keys (wrapped, non-exportable)         │  │
   │  └────────────────────────────────────────────────────────────┘  │
   │  ESP database: enrolment context, audit events                   │
   └──────────────────────────────────────────────────────────────────┘
```

| Component                                  | Role                                                                                                                                                         |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **KMS — Key Management Server**            | ASP-facing service that runs enrolment and signing journeys, talks to the KYC provider, CA and HSM interfaces. Never stores or logs AuthPINs in clear.       |
| **SAM — Subscriber Authentication Module** | Runs inside the HSM boundary. Verifies AuthPINs, enforces lockout, issues and validates single-use session tokens.                                           |
| **CHI — CA-HSM Interface**                 | Enrols the subscriber, generates the key pair and CSR in the HSM and links the issued certificate.                                                           |
| **SHI — Signing-HSM Interface**            | Requests signatures from the HSM only after SAM validates the session token. SHI has no access to private keys and may be operated at a trusted third party. |
| **AI — Authentication Interface**          | Carries the encrypted AuthPIN and nonce between KMS and SAM.                                                                                                 |
| **eMudhra CA**                             | Issues the long-term certificate from the CSR and verified eKYC data.                                                                                        |
| **ESP database**                           | Holds enrolment context, certificate IDs and audit events (retained ≥ 7 years).                                                                              |

## Security properties

* Private keys are generated in and never leave the HSM in clear; backups are wrapped under a non-exportable HSM key.
* AuthPIN is encrypted by KMS to the authenticated SAM public key and bound to the transaction ID.
* Verification material stored by SAM cannot be used to recover the AuthPIN (HMAC-SHA-256 with ≥128-bit random value).
* Session tokens are single-use, time-bound and bound to the exact document hashes and count.
* Secure session lifetime is at most 10 minutes.