In a Zero-Knowledge architecture, the management of encryption keys is a critical operational decision. StateWarden delegates the absolute authority of key custody to you.
We provide two distinct encryption modes, tailored to balance the operational requirements of large-scale deployments against the strict mathematical isolation of individual endpoints: Device Key Mode and Global Key Mode.
1. Device Key Mode (Maximum Isolation)
By default, StateWarden Realms are configured in Device Key Mode.
How it Works
When a new Agent is paired with the Realm and attempts its first backup, it autonomously generates a unique, highly secure Master Key. This key is displayed to the administrator once in the Dashboard during the initial setup phase. The administrator must save this key in a secure location (e.g., an Enterprise Password Manager).
The Security Profile
- Cryptographic Isolation: Every single server, workstation, and database node possesses its own distinct encryption key.
- Blast Radius Containment: If the Master Key for the
web-server-01backup is somehow compromised or leaked by an employee, the attacker gains absolutely zero insight into the backups ofdatabase-node-primary. - The Trade-off: Administrative overhead. Restoring 50 different servers requires an administrator to retrieve and input 50 different Master Keys into the respective Agents or Recovery ISOs.
Device Key Mode is the pinnacle of compartmentalized security and is highly recommended for environments processing Highly Classified, HIPAA, or Top Secret data.
2. Global Key Mode (Enterprise Operations)
For large-scale enterprise environments where speed of deployment and simplified disaster recovery are paramount, StateWarden offers Global Key Mode.
How it Works
Instead of each Agent generating a unique key, the Realm Administrator provisions a single, cryptographic Global Master Key.
Crucially, because StateWarden is a Zero-Knowledge system, this key is NEVER saved to the Artemis Control Plane database.
The Provisioning Process ("Late-Joiners")
When a new Agent (a "Late-Joiner") connects to a Realm operating in Global Key Mode, it enters a KEY_SETUP_REQUIRED state. It cannot perform backups because it does not have the key.
- The Administrator logs into the StateWarden Dashboard.
- The Administrator manually inputs the Global Master Key into a secure dialogue box.
- The Control Plane encapsulates the key within a quantum-resistant "PQ-Hybrid Payload" using the Agent's hardware-bound ML-KEM (Kyber) public key.
- The payload is transmitted to the Agent, where it is decapsulated directly into volatile RAM and instantly zeroized after use.
- The Dashboard immediately drops the key from its memory.
The Security Profile
- Operational Velocity: Restoring an entire datacenter (500 VMs) during a crisis requires only one Master Key to be managed and injected into the recovery processes.
- Deduplication Efficiency: Because all Agents use the same encryption key, the PrimeKEM engine achieves maximum cross-device deduplication on the Driad storage nodes. A Windows update installed on 500 workstations is only stored once globally.
- The Trade-off: If the Global Master Key is compromised, the entirety of the Realm's backup repository is exposed.
3. Switching Encryption Strategies
StateWarden enforces strict architectural boundaries to prevent accidental security degradation.
- You can upgrade a Realm from Device Key Mode to Global Key Mode.
- You cannot downgrade a Realm from Global Key Mode to Device Key Mode.
If you choose to initialize a Global Master Key, any existing devices with independent keys will continue to function using their original keys (legacy mode). However, all newly paired devices will strictly enforce the Global Key provisioning process.
Choose the strategy that aligns with your organization's specific threat model and disaster recovery SLAs.
StateWarden: Resilience Engineered.