openskills.info
Course catalog
Course Preview

Cryptographic Key Management

Cryptographic key management controls encryption, signing, and authentication keys from generation through use, rotation, recovery, and destruction. It keeps key material separate from protected data while governing who and what may use each key.

itIdentity, access, and cryptography

Cryptographic key management is the system of policies, roles, components, and records that controls cryptographic keys and their metadata. It covers the complete path from generation to destruction. The cryptographic algorithm transforms data, but the key determines who can reverse, authenticate, or authorize that transformation.

A strong cipher cannot compensate for an exposed, unavailable, misidentified, or misused key. Key management therefore treats a key as a governed security object rather than a value placed beside ciphertext.

The control plane and data plane

A cryptographic key management system, or CKMS, combines policy, procedures, software, hardware, and operator responsibilities. Its control plane creates key identities, attaches policy, changes lifecycle state, records use, and handles recovery. Its data plane performs or authorizes cryptographic operations.

A common arrangement separates three layers:

  1. A data-encryption key, or DEK, encrypts application data.
  2. A key-encryption key, or KEK, wraps the DEK so the DEK can be stored with the ciphertext in protected form.
  3. A key management service or hardware security module protects the KEK and enforces operations against it.

This arrangement is envelope encryption. The application can encrypt large data locally with a DEK while the CKMS handles a much smaller wrapped key. The stored record usually contains ciphertext, the wrapped DEK, an algorithm or format identifier, and the CKMS key identifier. It must also preserve any authenticated metadata required by the encryption format.

A hardware security module, or HSM, is a cryptographic module with a defined hardware boundary. It can generate keys and perform operations while restricting export of sensitive key material. A cloud KMS exposes managed key operations through an API. Some services use HSMs underneath; the operational distinction is who controls the boundary, availability design, policy, and administration.

Key roles are not interchangeable

Symmetric keys use the same secret material for the paired operation, such as encryption and decryption. Asymmetric keys form a public and private pair. The private key performs a sensitive operation such as signing or decryption. The public key supports verification or key establishment and still needs trustworthy metadata about its owner and purpose.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources