Key Management
Overview
Key management covers generating, storing, distributing, rotating, revoking, and destroying cryptographic keys — since strong encryption is worthless if the keys themselves are compromised.
Key concepts
- Key generation, storage, distribution, rotation, revocation
- Key escrow
- Hardware security modules (HSMs)
Tools & techniques
| Tool | Purpose | When to use |
|---|---|---|
| HSM (Hardware Security Module) | Secure key generation/storage/management | Enterprise-grade key protection |
How it works
Key management is the process of generating, storing, distributing, rotating, revoking, and destroying cryptographic keys. Strong encryption is ineffective if attackers can access or steal the keys themselves.
Lifecycle
| Term | Meaning |
|---|---|
| Key generation | Creating a cryptographic key. |
| Key storage | Securely protecting keys while they're not in use. |
| Key distribution | Securely providing keys to authorized users or systems. |
| Key rotation | Replacing an old key with a new one on a regular schedule. |
| Key revocation | Invalidating a key that's been compromised, lost, or no longer needed. |
Protecting keys at scale
| Term | Meaning |
|---|---|
| Key escrow | Securely storing a copy of an encryption key with a trusted third party. |
| Hardware security module (HSM) | A physical device that securely generates, stores, and manages cryptographic keys. |
| Key backup | A protected copy of a key usable for recovery if the original is lost. |