Cryptographic keying material

Detects cryptographic keying material records: keying-material, COMSEC or key-ceremony wording with actual key values (PEM private keys, hex key components) or populated custody details (custodians, HSM serials, KCVs, envelope numbers). Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: low
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (an actual key value (PEM private-key block or labelled hex key component/ZMK/ZPK/TMK/KEK/DEK) or a populated custody field (custodian, witness, HSM serial, key label/ID/version, KCV, ceremony date, safe/envelope number)), and 85 needs two distinct structures plus independent key-management-control (split knowledge, dual control, tamper-evident, cryptoperiod, rekey) evidence, so policies, blank forms and training text stay below 75.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth), Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: CIS Controls, DISP, ISO 27001, NIST CSF, PCI-DSS, SOC 2
Data categories: credentials, security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:cryptographic\s+keying\s+material|keying\s+material|COMSEC\s+(?:material|account|custodian)|key\s+ceremony\s+(?:record|log|script|minutes)|key\s+custodian\s+(?:log|register|record)|(?:master|zone\s+master|terminal\s+master)\s+key\s+components?)\b

Corroborative evidence keywords

split knowledge, dual control, tamper-evident, AES-256, TDES, zeroise, rekey, cryptoperiod, key loader, destroyed, government, agency, department, ministry, public sector, civil service, welfare, social services, public administration, statutory authority (+5 more)

Proximity: 300 characters

Should match

Cryptographic keying material must be returned to the COMSEC custodian at end of posting. — Discovery probe (65)
Key ceremony record - payment HSM Key custodian: J. Staffson KCV: 7D2A91 — Medium-tier probe (75) - populated custody fields
Zone master key components - key ceremony record 2026-09-18 Custodian A: J. Staffson; witness: R. Marsh HSM serial: PHSM-449102 Component 1: 0123 4567 89AB CDEF FEDC BA98 7654 3210 KCV: 7D2A91 Envelope number: TE-0418 (tamper-evident), dual control and split knowledge maintained. — High-tier probe (85) - key component value, custody fields and key-management controls

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: keying material is handled under dual control and split knowledge at all times. — Policy text
Key ceremony record template Key custodian: ________ Component 1: [insert] KCV: ________ — Blank template
Course module 3: a master key component is entered by each custodian and verified with a KCV. — Training framing

Known false positives

Key management standards (NIST SP 800-57, PCI PIN) describe key components and ceremonies. Mitigation: Guidance/training framing is excluded; enforcement needs key values or populated custody fields.