> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/remote-key-storage/authpin-and-signer-security.md).

# AuthPIN and Signer Security

Remote Key Storage enforces **sole control** of the signing key by the subscriber through two factors:

1. **AuthPIN** — known only to the subscriber, verified only inside the HSM (SAM).
2. **Application authentication** — the subscriber's authenticated session with the ASP.

## AuthPIN rules

| Rule       | Value                                                                                                        |
| ---------- | ------------------------------------------------------------------------------------------------------------ |
| Length     | 6 characters                                                                                                 |
| Set during | Enrolment, in a single secure session                                                                        |
| Transport  | Encrypted by KMS to the SAM public key with a fresh nonce                                                    |
| Storage    | HMAC-SHA-256 verification material with ≥128-bit random value, inside HSM-protected storage; not recoverable |
| Logging    | Never logged or stored in clear by any component                                                             |

## Lockout policy

| Event                                 | Result                                                        |
| ------------------------------------- | ------------------------------------------------------------- |
| 10 consecutive wrong AuthPIN attempts | Account locked for at least 1 hour                            |
| 3 lockout cycles                      | Permanently locked                                            |
| Reset                                 | Requires strong re-authentication, such as video verification |

## Session tokens

* Issued by SAM after successful AuthPIN verification.
* **Single-use and time-bound.**
* **Bound** to the transaction ID, the exact authorised document hashes and the number of documents (max 10).
* Any mismatch, reuse or timeout invalidates the token and requires re-authentication.
* The signer can reject individual documents before the token is issued ("User Rejected").

## ASP responsibilities

* Authenticate the subscriber to your application (second factor) before initiating signing.
* Never collect or transmit the AuthPIN — it is entered only on eMudhra's KMS pages or SDK screens.
* Store `txn`, `resCode` and signed outputs for audit.