Update cryptographic-details-key-manager.mdx

Author: nerda-codes

pages/key-manager/reference-content/cryptographic-details-key-manager.mdx

@@ -13,7 +13,9 @@ dates:
   posted: 2025-05-12
 ---
 
-## Cryptographic primitives
+## Cryptographic primitives in Scaleway Key Manager
+
+This page provides information on the core cryptographic mechanisms used by Key Manager. It explains how cryptographic keys are generated, managed, and used to encrypt data. Key Manager uses cryptographic mechanisms in compliance with cryptographic guidelines issued by [France's national cybersecurity agency](https://cyber.gouv.fr/) in the ANSSI-PA-079 recommendations. to ensure the confidentiality and integrity of customer data.
 
 ### Random number generation
 
@@ -27,19 +29,19 @@ This CSPRNG is based on the ChaCha-based pseudorandom number generator provided
 - True Random Number Generators (TRNGs), including the `RDSEED` and `RDRAND` instructions available on AMD64 processors
 
 <Message type="note">
- Complies with ANSSI-PA-079 Recommendation R14.
+ The section above is in compliance with [ANSSI-PA-079 Recommendation R14](https://cyber.gouv.fr/sites/default/files/2021/03/anssi-guide-selection_crypto-1.0.pdf), which mandates the use of a cryptographically secure and appropriately seeded pseudorandom generator for key and IV material.
 </Message>
 
 <Message type="important">
- The information in the section above does not apply to keys imported via the Bring Your Own Key (BYOK) mechanism.
+ The information above applies only to keys generated by Key Manager. If you import a key using the Bring Your Own Key (BYOK) mechanism, these safeguards are not applied to your key material.
 </Message>
 
 
 #### Customer-provided KEKs (BYOK)
 
 Scaleway Key Manager supports Bring Your Own Key (BYOK), allowing customers to import their own key material. In this model, Scaleway does not generate keys on behalf of the customer. Instead, the responsibility for generating strong key material lies with the user.
 
-Imported key material is is not used directly, but processed using the **HKDF algorithm with SHA-256** as the hash function, incorporating secure random bytes as salt.
+To protect against direct reuse, imported key material is not used directly. Instead, it is processed using the HKDF algorithm (HMAC-based Key Derivation Function) with SHA-256 as the hash algorithm, incorporating secure random bytes added as a salt value.
 
 ### Symmetric encryption
 
@@ -48,7 +50,7 @@ Scaleway Key Manager uses **AES-256-GCM** (AES with a 256-bit key in Galois/Coun
 To reduce the risk of key overuse, plaintext payloads are limited to a maximum size of 64 KiB. a unique 96-bit initialization vector (IV) is generated using the CSPRNG described in the section above.
 
 <Message type="note">
-  Complies with ANSSI-PA-079 Recommendations R1, R4, and R12.
+  The section above is in compliance with [ANSSI-PA-079 Recommendations R1, R4, and R12] regarding the choice of secure, authenticated symmetric encryption (R1), key and IV uniqueness (R4), and payload size limitations and proper use of AEAD modes (R12). Refer to the ANSSI-PA-079 recommendations [documentation](https://cyber.gouv.fr/sites/default/files/2021/03/anssi-guide-selection_crypto-1.0.pdf) for more details.
 </Message>
 
 <Message type="important">