Key Management

Key management encompasses the policies and procedures for generating, storing, distributing, rotating, and destroying cryptographic keys used for encryption.

Key management is critical to encryption security—weak key management undermines even strong encryption algorithms.

Key lifecycle: 1. Generation: Create keys with sufficient entropy 2. Distribution: Securely share keys with authorized parties 3. Storage: Protect keys at rest (HSMs, key vaults) 4. Usage: Control how keys are used 5. Rotation: Periodically replace keys 6. Destruction: Securely delete expired keys

Key management solutions: - Hardware Security Modules (HSMs) - Cloud KMS (AWS KMS, Azure Key Vault, GCP Cloud KMS) - HashiCorp Vault - Secrets managers

Best practices: - Never hardcode keys in source code - Rotate keys regularly (annually minimum) - Separate key management from encrypted data - Use envelope encryption for large data

Why It Matters

Encryption is only as strong as its key management. Hardcoded keys in source code, keys stored alongside encrypted data, or keys that are never rotated create false security—the data appears encrypted but is effectively accessible to anyone with the key. PCI DSS explicitly requires documented key management procedures, and auditors across all frameworks check that encryption keys are properly generated, stored, rotated, and destroyed.

Key Points

Keys must be as protected as the data they encrypt

Use HSMs or cloud KMS for key storage

Rotate keys at least annually

Never store keys in source code

Separation of duties for key management

Applicable Compliance Frameworks

SOC 2 ISO 27001 PCI DSS HIPAA

Related Terms

Encryption at Rest

Encryption at rest protects data stored on disks, databases, or storage systems by converting it to an unreadable format that requires a key to decrypt.

Secrets Management

Secrets management is the secure storage, access control, and rotation of sensitive credentials like API keys, passwords, certificates, and tokens.