Hardware where the profile allows
Secure Enclave, StrongBox, TPM or HSM may be used depending on platform, algorithm and validated integration.
PUBLIC CRYPTOGRAPHIC DOCTRINE
Choices made by use case.
Gankpo prioritises open, auditable mechanisms while using algorithms required for interoperability. The public policy distinguishes the .gkp container, standard signatures, digital identity and key protection.
Ed25519P-256BLAKE3SHA-256BY PROFILE
01
The mechanism depends on format and context.
.gkp signaturesEd25519 · ECDSA P-256
Current production registry; 64-byte primary slot.
.gkp integrityBLAKE3
Payload fingerprint and header control in the v4 container.
Authenticated encryptionAES-256-GCM · ChaCha20-Poly1305
Payload protection according to the creation path and policy.
Key derivationArgon2id → HKDF-SHA-256
Derived from declared parameters and salts.
PKI / PDF interoperabilitySHA-256 · X.509 · CMS · PAdES
Mechanisms separate from the primary format, validated within documented scopes.
Credentials and protocolsCOSE · JWS · P-256 selon profil
Choices follow standards and interoperability, without blanket exclusion of NIST curves.
KEY CONTROL
Actual protection depends on the device.
No blanket claim
The site does not claim that all keys are non-exportable, hardware-backed or certified. Each journey must publish its actual level.
PUBLIC STATUS