One key is not enough. The locker opens only during the permitted time window, and every opening is recorded. The difference is that the “locker” contains encrypted data, so stealing the server does not reveal the paper.
Explained in plain English for any non-technical reader.
Three compromised custodian credentials or devices could satisfy the threshold. Compensating controls: independent reporting lines, device-bound credentials, approval-pattern anomaly detection, ceremony logging, rapid revocation and mandatory post-event review.
| # | Leak vector | Typical pattern | University Edition response |
|---|---|---|---|
| V0 | Sealing-stage insider / compromised workstation | Readable paper is copied before encryption or the sealing workstation is compromised | Outside the current cryptographic boundary. University controls apply before sealing; a controlled-authoring module is on the roadmap. |
| V1 | Printing press insider | Paper photographed during bulk printing | Central printing is eliminated. |
| V2 | Transport / logistics | Sealed trunks opened and resealed | Papers never travel physically. |
| V3 | Strong-room custody | Locker or treasury access collusion | No physical custody phase exists. |
| V4 | Centre insider | Paper opened or photographed early | Scheduled release, dual control and centre watermarking. |
| V5 | Digital compromise | Server breach or administrator abuse | Client-side encryption, separated approvals and audit chain. |
| V6 | Quorum compromise | Three custodian credentials or devices are compromised or collude | Independent reporting lines, device attestation, approval-pattern alerts, rapid revocation and evidence review. |
Exam Locker therefore separates creation, approval, release and centre access. One compromised person is not enough to expose a paper.
Exam Locker protects the final approved paper from the moment the Sealing Officer encrypts it. From that point onward, the platform removes printing-press, transport and strong-room exposure.
Drafting, moderation and committee circulation are outside this version's cryptographic boundary. Universities must control that stage through confidentiality policy, restricted access and documented approval. A controlled-authoring module may extend scope later.
Primary custodian. Holds one encrypted share and authorises the examination release ceremony.
Primary custodian. Holds an independent share on a registered credential.
Primary custodian. Holds an independent share and witnesses release.
Pre-provisioned alternate custodian with a distinct share created at sealing.
Pre-provisioned alternate custodian with a distinct share created at sealing.
Creates each centre-specific edition, encrypts it locally and never acts as a release custodian.
Authenticates the assigned centre and conducts controlled printing. Does not hold a paper-key share.
Receives read-only custody records and verification exports for internal inquiry, police or appointed review.
Stores ciphertext and encrypted share capsules. It holds no custodian private key and cannot reconstruct any edition DEK.
Managing users, centres or schedules never grants the ability to read an examination paper.
The server routes encrypted capsules but owns no custodian private credential.
An alternate owns a distinct share created before sealing. No share is copied on exam day.
Fewer than three available custodians causes a safe delay; the threshold never drops.
A fresh 256-bit DEK is generated for every centre-specific edition. Each edition DEK is split into five shares. One 3-of-5 quorum ceremony per exam session authorises dispatch of the precomputed encrypted capsules for all authorised editions in that session - not one ceremony per centre.
A unique DEK is generated for every centre-specific edition. A centre that reconstructs its own DEK cannot decrypt another centre's bundle.
For 45 centres, sealing creates 45 DEKs and 225 encrypted share capsules. Custodians approve once per exam session; the approval authorises dispatch of the precomputed capsules for all listed editions.
This preserves operational practicality without weakening centre isolation or forensic attribution.
Each share is encrypted to one custodian public key. The private credential remains device-bound or in a university-controlled secure credential store.
An encrypted recovery copy may exist in an offline institutional vault. Recovery requires identity re-verification, two-person authorisation and a logged ceremony. There is no universal master share.
An alternate approver receives nothing at T-30. They already own a separate share created at sealing and may join the same 3-of-5 quorum.
A custodian can be disabled before release. Suspected credential compromise after sealing requires re-sealing every affected edition with a fresh DEK and five new shares.
The platform holds ciphertext, manifests and encrypted capsules only. It cannot open three capsules and never reconstructs an edition DEK.
Centre code and session information appear on every page, discouraging resale and anonymous circulation.
Subtle, redundant page variations encode the centre identity and survive ordinary photographs and recompression after testing.
Physical copy numbers support reconciliation with candidate counts and surplus destruction.
Changing or deleting a historical event breaks the chain from that point onward. Regular external digest copies make silent history rewriting detectable.
Successful and failed actions are recorded in one ordered custody history.
Cryptographic links expose alteration, deletion or event reordering.
A verification package can be supplied to the university, police or an appointed inquiry.
Encrypted bundles are pre-delivered. Only the signed, short-lived release response requires live connectivity.
The session pauses safely and resumes under the same authorised centre identity after power returns.
No quorum release occurs. Replacement editions are sealed under fresh DEKs and new shares.
A pre-authorised backup printer may be selected. The change is observed, approved and recorded.
Any pre-provisioned alternate may join. Fewer than three available custodians causes a safe delay; no new share is issued.
The client rejects requests outside the window, expired messages, reused nonces or a centre/session mismatch and raises an alert.
From local reconstruction to completed printing, the signed client is the security boundary. Screen capture, memory extraction and modified-client resistance are endpoint controls and must be tested explicitly.
Sign-in, printer and bundle status.
Who has approved and when.
Expected versus produced copies.
Early attempts, mismatches and failures.
It is deployable on standard cloud or university infrastructure, while preserving separation of duties, client-side encryption and evidence-grade logging.
boardsUniversity tenant, governance and retention settings.
examsSchedule, session, release window and status.
papersApproved paper identity, version and sealing state.
paper_editionsCentre-specific ciphertext, edition ID and isolated DEK metadata.
manifestsSHA-256 hashes, sizes, nonce, algorithm and object references.
centersAuthorised locations, registered clients and printer policy.
center_staffSuperintendent, Observer and controlled-session assignments.
custodiansFive named share holders, credential state and reporting line.
share_capsulesFive encrypted Shamir-share capsules per centre edition.
approval_ceremoniesOne session-level quorum ceremony and signed approvals.
release_messagesSigned, expiring, nonce-bound, one-time release responses.
unlock_sessionsCentre client, edition, staff, timestamps and consumption state.
print_jobsPrinter identity, copies requested, produced and reconciled.
attestationsClosure, surplus destruction and observer confirmation.
custody_eventsAppend-only hash-chained event chronology.
anchorsExternal digest witnesses that make silent history rewriting detectable.
alertsReplay, early access, quorum anomalies, mismatches and failures.
audit_exportsEvidence bundle, verification result and recipient record.
The anchors table stores periodic chain-head digests, witness identifiers, timestamps and receipts. The audit_exports table records the exact evidence package and verification result supplied to an authorised reviewer.
AES-256-GCM is the mandatory paper-encryption algorithm for this final edition. A fresh random 256-bit DEK and unique 96-bit nonce are generated for every centre-specific edition. Algorithm agility may be designed internally, but the tender baseline is not written as “either/or.”
Each edition DEK is split with Shamir Secret Sharing, threshold 3-of-5. Each share is encrypted to one named custodian public key. The platform stores encrypted capsules only.
Every release response is digitally signed and bound to exam_id, paper_id, edition_id, centre_id, session_id, release_window, nonce and expiry. The centre client records one-time consumption and rejects replay.
A signed Electron/Tauri or native kiosk client is the security-bearing endpoint. A browser prototype may validate workflow, but is not presented as equivalent security.
Persistent OS spooling is disabled where supported. Temporary material uses an encrypted volume or memory-backed storage, followed by verified cleanup and printer-cache handling.
Custodian credentials are device-bound or held in a university-controlled secure credential store. Recovery, revocation and alternate activation follow the dedicated key-custody page.
CBT requires devices, reliable power and connectivity, accessibility arrangements, secure test-delivery software and operational change at every seat. Many descriptive, diagrammatic, open-book or institution-specific examinations still require paper.
It preserves the familiar paper examination while eliminating bulk pre-printing, physical transport and strong-room custody. Universities can adopt it without redesigning the examination itself.
Commission independent application, infrastructure and source-code assessment through an appropriately empanelled information-security auditing organisation before production use.
Evaluate independent software testing, security assessment and product-certification options appropriate to the deployment and procurement context.
Map hosting, identity, logging, incident response, data retention and government-cloud requirements where applicable to the institution or funding authority.
Assess legal applicability with counsel. The Act addresses unfair means in defined public examinations; a university must determine whether its examination and authority fall within the statutory definitions.
The pilot should produce a threat model, secure-development evidence, independent test reports, incident procedures, retention policy and an auditable operating manual.
Map roles, provision five custodians, register centre clients, define recovery and configure the examination session.
Run cancellation, missing-custodian, network failure, printer failure, replay and incident-response exercises.
Conduct the live examination, export evidence, measure watermark recovery and document every exception.
Authorise a university discovery and pilot-design workshop to define the first examination, participating centres, named custodians, success metrics, implementation responsibilities and commercial proposal.
The platform holds ciphertext and encrypted capsules, not examination content.
Every centre-specific edition uses a fresh DEK. One centre cannot open another centre's bundle.
A fixed 3-of-5 quorum is required; alternate custodians are pre-provisioned.
Approve the pilot-design workshop and select the first university examination for controlled implementation.