Cryptographic Key Management
Cryptographic key management controls encryption, signing, and authentication keys from generation through use, rotation, recovery, and destruction. It keeps key material separate from protected data while governing who and what may use each key.
itIdentity, access, and cryptography | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic - Cryptographic Key Management
Cryptographic key management is the system of policies, roles, components, and records that controls cryptographic keys and their metadata from generation to destruction. The algorithm transforms data; the key decides who can reverse, authenticate, or authorize that transformation. A strong cipher cannot fix an exposed or missing key. Key management therefore treats a key as a governed security object rather than a value placed beside ciphertext.
A cryptographic key management system, or CKMS, combines policy, procedures, software, hardware, and operators. Its control plane creates key identities, attaches policy, changes lifecycle state, records use, and handles recovery. Its data plane performs or authorizes cryptographic operations.
A common arrangement uses envelope encryption. A data-encryption key (DEK) encrypts application data. A key-encryption key (KEK) wraps the DEK. A key management service or HSM protects the KEK and enforces operations against it. Stored records usually keep ciphertext, the wrapped DEK, algorithm identifiers, and the CKMS key identity, plus any authenticated metadata the format requires. The application can encrypt large data locally while the CKMS handles a much smaller wrapped key.
Keys need identity, owner, allowed operations, rotation, destruction, and evidence. Availability is part of security: keys you cannot recover after an incident become an outage that invites unsafe workarounds. Centralizing keys improves policy and audit and also concentrates blast radius across every workload that depends on the same KEK.
Read the Intro for the control-plane model and envelope pattern. Use the Cheatsheet when you need lifecycle and role maps. Landscape and Timeline place CKMS designs among related crypto tooling; Updates tracks the NIST SP 800-57 publication line this course centers on.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final
Supports
- Key classifications and purposes, including data-encryption, wrapping, signing, authentication, agreement, and derivation keys
- Cryptoperiods, key metadata, protection requirements, lifecycle states, four management phases, inventory, backup, compromise, recovery, and destruction
- Distinctions among active, suspended, deactivated, compromised, and destroyed processing rules
- https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf
Supports
- Detailed state transitions, metadata fields, backup availability, integrity protection, key dependencies, and audit retention
- https://csrc.nist.gov/pubs/sp/800/57/pt2/r1/final
Supports
- Organizational key-management policy, planning, roles, documentation, and centralized or decentralized structures
- https://csrc.nist.gov/pubs/sp/800/130/final
Supports
- CKMS design as policies, procedures, hardware, software, firmware, devices, metadata, and access controls
- https://csrc.nist.gov/pubs/sp/800/133/r2/final
Supports
- Generation, derivation, and establishment of keys used by approved cryptographic algorithms
- https://csrc.nist.gov/pubs/sp/800/38/f/final
Supports
- Key wrapping as confidentiality and integrity protection for cryptographic keys
- AES Key Wrap and AES Key Wrap with Padding
- https://csrc.nist.gov/pubs/sp/800/152/final
Supports
- CKMS design, implementation, operation, disaster recovery, security assessment, and policy requirements
- https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html
Supports
- Application key lifecycle, generation, distribution, storage, backup, audit, compromise response, and recovery guidance
- Limiting plaintext key exposure, separating key purposes, and mapping key use
- https://csrc.nist.gov/projects/key-management/key-management-guidelines
Supports
- Current NIST key-management publication set and roles of its three SP 800-57 parts
- https://docs.oasis-open.org/kmip/spec/v1.0/os/kmip-spec-1.0-os.html
Supports
- Managed-object and client-server operation model for interoperable key management
- October 2010 KMIP Version 1.0 standard milestone
- https://developer.hashicorp.com/vault/docs/secrets/transit
Supports
- Cryptographic operations as a service, data-key generation, envelope encryption, named key versions, and key rotation
- https://developer.hashicorp.com/vault/api-docs/secret/transit
Supports
- Rotation and rewrap behavior without returning application plaintext
- https://github.com/sindresorhus/awesome
Supports
- Required Awesome-list discovery starting point and route to the Cryptography list
- https://github.com/sobolevn/awesome-cryptography
Supports
- Discovery of GnuPG, SOPS, Blackbox, and git-crypt as relevant ecosystem projects
- https://getsops.io/
Supports
- Structured encrypted-file workflow and use of cloud KMS, age, or PGP recipients
- https://www.gnupg.org/
Supports
- OpenPGP encryption, signing, public-key directories, and key-management capabilities
- https://github.com/StackExchange/blackbox
Supports
- GPG-encrypted files and administrator keyrings stored through repository workflows
- https://github.com/AGWA/git-crypt
Supports
- Transparent selected-file encryption and repository key distribution through Git filters
- https://aws.amazon.com/kms/
Supports
- AWS KMS placement as a managed cloud key service with integrated encryption and centralized controls
- https://aws.amazon.com/documentation-overview/kms/
Supports
- Envelope encryption, lifecycle permissions, automatic rotation, and AWS service integrations
- https://azure.microsoft.com/en-us/products/key-vault
Supports
- Azure Key Vault placement for cloud key, secret, and certificate protection
- https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/backup-restore
Supports
- Managed HSM backup of keys, versions, attributes, tags, and role assignments under a protected security domain
- https://cloud.google.com/security/products/security-key-management
Supports
- Google Cloud KMS placement for managed cloud key operations and protection levels
- https://cloud.google.com/kms/docs/resource-hierarchy
Supports
- Key rings, keys, versions, locations, protection levels, and IAM access boundaries
- https://www.ibm.com/products/key-protect
Supports
- IBM Key Protect placement as a managed key service integrated with IBM Cloud resources
- https://cloud.ibm.com/docs/key-protect?topic=key-protect-envelope-encryption
Supports
- IBM Key Protect envelope-encryption flow and customer-managed integration
- https://cpl.thalesgroup.com/encryption/ciphertrust-manager
Supports
- CipherTrust Manager lifecycle operations, central policy, backup, clustering, deactivation, and deletion
- https://www.fortanix.com/platform/data-security-manager/key-management-service
Supports
- Fortanix DSM centralized key lifecycle, HSM-backed operations, identity policy, and audit placement
- https://csrc.nist.gov/pubs/fips/46/final
Supports
- January 1977 DES standard milestone and hardware implementation context
- https://csrc.nist.gov/pubs/fips/140/final
Supports
- April 1982 security requirements for equipment implementing DES
- https://csrc.nist.gov/pubs/fips/140-1/upd1/final
Supports
- January 1994 FIPS 140-1 milestone and four cryptographic-module security levels
- https://csrc.nist.gov/pubs/fips/140-2/final
Supports
- May 2001 FIPS 140-2 milestone and module requirements including key management
- https://csrc.nist.gov/pubs/fips/197/final
Supports
- November 2001 AES standard milestone and its three key sizes
- https://csrc.nist.gov/pubs/sp/800/57/pt1/final
Supports
- August 2005 first final SP 800-57 Part 1 milestone
- https://docs.oasis-open.org/kmip/profiles/v1.0/os/kmip-profiles-1.0-os.html
Supports
- October 2010 KMIP 1.0 profiles and standard date
- https://csrc.nist.gov/pubs/fips/140-3/final
Supports
- March 2019 FIPS 140-3 milestone and updated cryptographic-module security requirements
- https://www.nist.gov/news-events/news/2020/05/nist-publishes-special-publication-sp-800-57-part-1-revision-5-0
Supports
- May 2020 SP 800-57 Part 1 Revision 5 milestone and expanded metadata, access-control, authentication, and inventory guidance