Key Management

Key management refers to processes and procedures employed by an organization to generate, protect, use, and dispose of cryptographic keys over their lifetime. Moreover, secure use of cryptographic algorithms mainly depends on keeping private keys in symmetric and asymmetric encryption techniques confidential. In addition, cybercriminals who manage to obtain or guess a secret key can compromise the confidentiality and integrity of the data protected by the secret key. Proper cryptographic key management includes secure key generation, key storage, separation of duties (SoD), dual control, split knowledge, timely key rotation, key change and key destruction procedures. Furthermore, key management is a serious concern when cryptographic based protection measures are involved. However, most of the failures of cryptosystems are primarily based on key management and implementation vulnerabilities rather than the algorithms. Besides, there are two factors that are important for a secure cryptographic key, namely key length and randomness.  Good key selection depends on the quality and availability of random numbers. Because the longer the cryptographic key, the more difficult it is to compromise cryptographically encrypted messages.

• Key Generation: The first critical step of key management lifecycle is its secure generation.
• Key Protection: Once long and random cryptographic keys are generated, the next important issue is on how to securely storing the key. Furthermore, if the protection of the private encryption keys are compromised, it will pave a way for the cryptographic key compromise. And it will enable the cybercriminal to view messages encrypted through the keys.
• Key Encryption Keys: Systems and applications that employ encryption techniques must receive their encryption keys in some manner. Besides, a malicious actor may be able to probe the systems and applications in an attempt to discover the encryption key so that she/he may decrypt the communication employed by the systems and applications. That is where the use of encryption techniques are applied to protect the encryption key. This is known as key encryption key (KEK).
• Key Custody: It refers to the processes, policies, procedures and other mechanisms that are concerned with the management of the cryptographic keys.
• Key Rotation: It is the process of issuing a new encryption key and re-encrypting the data protected with the new key. Key rotation may be applied when key compromise, expiration and rotation of personnel occurs.
• Key Disposal: It refers to the processes and procedures of decommissioning the encryption key when it lifecycle ends.