Skip to content
1Claw Academy
← Curriculum
Advanced

Advanced Security

Go deep on the HSM key hierarchy, CMEK, MPC, Shroud, and risk.

By the end of this track

You’ll be able to configure CMEK, MPC custody, TEE-routed inference, and step-up authentication for treasury operations.

11 lessons~31 min33 questions
Start → Key hierarchy and the HSM
  1. 1Key hierarchy and the HSMSee how envelope encryption keeps a stored secret useless without KMS access.
  2. 2Lab: the key hierarchy under compromiseLabBuild a KEK and DEK tree, take a shell on the application server, then rotate the KEK and watch it change nothing.
  3. 3Customer-managed keys (CMEK)Add a client-side AES-256-GCM layer so 1Claw stores only your key's fingerprint.
  4. 4Lab: lose the key and find out what that meansLabEncrypt client-side, hand the server only a fingerprint, then delete your key and try every recovery path.
  5. 5MPC secret storageSplit a secret's DEK across parties so no single holder can reconstruct it.
  6. 6Shroud TEE proxyRoute a chat completion through Shroud so it is inspected inside a hardware TEE.
  7. 7Lab: change one line and fail attestationLabCompute a measurement, verify it, then add a harmless comment and watch the enclave refuse to be trusted.
  8. 8Zero trust and the risk enginePlant a honeytoken canary so any read trips a critical verdict and revokes sessions.
  9. 9Human Factor Auth for treasuryRequire a password or passkey from a real person before a treasury wallet can send, swap, or export.
  10. 10OIDC federation and Sign in with 1ClawLet external systems verify 1Claw-issued JWTs directly, so you can drop static API keys at the boundary.
  11. 11Lab: check what a real federated token would need to passLabUse 1Claw's real issuer and real JWKS to write the audience check the federation lesson described, against the actual production values rather than invented ones.