ICRC case study

The problem

Humanitarian data can put lives at risk. People affected by conflict keep identity documents and personal records on RedSafe. Vault encrypts them, but Vault itself has to be unsealed: manual unseal key shares depend on people being reachable, and a cloud KMS would give the hosting provider the last word.

How DuoKey helps

DuoKey is Vault's auto-unseal provider. Vault's root key is wrapped by a seal key held in DuoKey Multi-Party Computation, which never exists in one place. Vault starts and unseals without human key holders, and without DuoKey a copy of the data, or of Vault itself, stays sealed.

How it works

Step by step, where the keys go

01 / 04
A document goes into the RedSafe vault
A person affected by conflict adds a passport, a birth certificate or a medical record to RedSafe's digital vault, from a phone or the web app.
02 / 04
Vault unseals only through DuoKey
At start-up, HashiCorp Vault asks DuoKey to unwrap its root key. The seal key stays inside DuoKey MPC. No operator holds unseal key shares.
03 / 04
Beneficiary data is encrypted before storage
Once unsealed, Vault encrypts each record before it is stored. What reaches storage is ciphertext.
04 / 04
Without DuoKey, everything stays sealed
A copy of storage or of Vault cannot be decrypted without the seal key in DuoKey, and the ICRC decides who can reach it.

Security leadership

The questions this programme had to answer

What changed

How DuoKey keeps RedSafe's encryption under ICRC control

Auto
Vault unseals without key holders
No unseal key shares to distribute, store or gather. Vault restarts and unseals on its own.
MPC
The seal key is never in one place
The key that protects Vault's root key is split across MPC nodes, with no physical HSM appliance.
ICRC
The organisation keeps the last word
Without the seal key in DuoKey, Vault stays sealed and its data unreadable. The hosting provider never holds it.
Proof
Every unseal on record
Each unseal request is logged by DuoKey, independently of the hosting provider.

More programmes

Volkswagen

OTA that stays under OEM authority.

View case study

Swiss energy operator

Board papers protected with a key Microsoft does not hold.

View case study

Major German bank

Microsoft 365 for a bank, with the key in the bank's hands.

View case study

Swiss fintech bank

Blockchain transactions signed without a complete key ever existing.