> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/remote-key-storage/remote-key-storage-overview.md).

# Remote Key Storage Overview

**Remote Key Storage** gives a subscriber a **long-term Digital Signature Certificate whose private key is held in an eMudhra HSM** instead of on a USB token. The subscriber unlocks the key for each signing transaction with an **AuthPIN** that is verified only inside the HSM boundary.

It implements the CCA *eSign Remote API Specification 1.1* and Section 10 / Annexure I of the *e-Authentication Guidelines for eSign* (v1.9), and is built on top of the eSign v3 eKYC account.

## At a glance

| Attribute                     | Value                                                                                                                |
| ----------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| Specification                 | eSign Remote API 1.1 (builds on eSign API 3.x)                                                                       |
| Prerequisite                  | Active eMudhra eKYC account (see [eSign v3 registration](file:///0255771/eSign-v3/eKYC%20Account%20Registration.md)) |
| Certificate                   | Long-term DSC; default validity 2 years                                                                              |
| Default algorithm             | ECC (P-256) with SHA-256; RSA available                                                                              |
| Key storage                   | FIPS 140-3 Level 3 HSM; never exported in clear; backups HSM-wrapped                                                 |
| Signer authentication         | AuthPIN (6 characters, verified in SAM/HSM) + ASP application authentication                                         |
| Documents per authorisation   | Up to 10                                                                                                             |
| Interaction                   | Asynchronous with callback and status API                                                                            |
| Renewal / re-key / suspension | Not permitted — enrol a new certificate instead                                                                      |
| Revocation                    | Key deleted within 15 minutes of revocation                                                                          |

## Benefits

* **No token logistics** — sign from any device, anywhere.
* **Sign repeatedly** with the same certificate and identity — ideal for professionals and executives.
* **Batch signing** — authorise up to 10 documents with one AuthPIN entry.
* **Strong security** — keys never leave the HSM; PIN verification and session tokens enforced inside the HSM boundary.

## Typical users

* Chartered Accountants, Company Secretaries and directors filing on MCA, GST and Income Tax portals
* Doctors signing prescriptions and reports
* Bank and corporate approvers signing sanction letters and agreements
* Government officers signing certificates and orders