Security Best Practices

Essential security practices for production deployments.

Key Management

Private Key Storage

Development:

mkdir -p ~/.beltic/keys
chmod 700 ~/.beltic/keys
chmod 600 ~/.beltic/keys/*.pem

Production:

• Use HSM or KMS (AWS KMS, Azure Key Vault, GCP KMS)
• Never store keys in code or environment variables
• Implement key rotation (90-day schedule)

Key Rotation

// 1. Generate new key
const newKey = await generateKeyPair('EdDSA');

// 2. Update DID document with new key
await updateDIDDocument(newKey.publicKey);

// 3. Re-sign active credentials
await reissueCredentials(newKey.privateKey);

// 4. Securely delete old key after grace period
await secureDelete(oldKey);

Credential Issuance

Verification Before Signing

1. Identity verification - KYC/KYB checks complete
2. Schema validation - All required fields present
3. Business logic - Conditional rules pass
4. Security checks - No prohibited content

Appropriate Expiration

• Developer credentials: 6-12 months
• Agent credentials: 3-6 months
• High-risk use cases: 3 months with renewal

Credential Verification

Always Check

1. Signature - Cryptographic validity
2. Issuer - From trusted issuer list
3. Expiration - Not expired or not-yet-valid
4. Revocation - Check status list
5. Policy - Meets requirements

Trusted Issuer List

const trustedIssuers = [
  'did:web:beltic.com',
  'did:web:issuer.example.com'
];

if (!trustedIssuers.includes(result.issuer)) {
  throw new Error('Untrusted issuer');
}

Audit & Monitoring

Log All Verifications

await logVerification({
  timestamp: new Date(),
  credentialId: result.credential.credentialId,
  issuer: result.issuer,
  subject: result.subject,
  outcome: 'accepted',
  policy: policyResult
});

Alert on Anomalies

• Revoked credential usage attempts
• Failed verification spikes
• Unexpected issuer appearances
• Policy violation patterns

Compliance

Data Handling

• PII in credentials: Minimize or hash
• Audit logs: Retain for compliance period
• GDPR: Right to erasure for credential subjects

Regulatory Alignment

• NIST AI RMF: Map fields to controls
• SOC 2: Document verification processes
• ISO 27001: Include in ISMS

See Also

• Trust Chain Verification
• Status Lists & Revocation