Transit Encryption

The Transit engine provides encryption-as-a-service so applications never need to hold key material. Supported operations include encrypt, decrypt, sign, verify, hmac, and rewrap. Each key is versioned; decrypting a ciphertext written under an old version transparently succeeds while new ciphertext is always produced with the latest version.

Key rotation generates a new version without re-encrypting historical data. Rewrap is available to migrate ciphertext forward in bulk when needed. Supported key types include AES-256-GCM, ChaCha20-Poly1305, RSA-2048/4096, and Ed25519.

Key Configuration

• Key type (symmetric, signing, HMAC)
• Rotation schedule per key
• Allowed operations per role
• Minimum key version for decrypt