Key Management

Encryption is only as strong as the security of the keys that control it. A perfectly encrypted database is useless to an attacker — unless they find the key. Key management is the practice of creating, storing, distributing, rotating, and retiring those keys safely.

The Master Lock Analogy

Think of your encryption key as the master key to a building. The locks on every door are world-class. But if you hang the master key on a hook next to the front door, the locks mean nothing. Key management is everything you do to keep that master key safe — who can hold it, where it lives, when it changes, and how you destroy it when it is no longer needed.

The Key Lifecycle

Every encryption key goes through a lifecycle. Managing this lifecycle properly prevents old or compromised keys from being used.

Key Lifecycle:
--------------------------------------------------
1. Create    → Generate a cryptographically strong key
2. Distribute → Deliver the key only to authorized systems
3. Store     → Keep the key in a secure, access-controlled vault
4. Use       → Encrypt and decrypt authorized data
5. Rotate    → Replace the key periodically with a new one
6. Revoke    → Immediately disable a key if it is compromised
7. Destroy   → Permanently delete the key when it is no longer needed
--------------------------------------------------

Key Management Systems (KMS)

A Key Management System is a dedicated service that handles the full key lifecycle for you. It stores keys in hardware-protected environments, enforces access controls, logs every use of a key, and automates rotation. All major cloud providers offer managed KMS services.

Where NOT to Store Keys

Many security incidents happen because keys are stored in the wrong place. Never store encryption keys in:

• Source code repositories (even private ones — developers push keys to GitHub by mistake constantly)
• Environment variables in plain text without a secrets manager
• The same storage location as the data they encrypt
• Shared documents or spreadsheets
• Email or chat messages

Customer-Managed vs. Provider-Managed Keys

Provider-Managed Keys

The cloud provider generates, stores, and rotates keys on your behalf. This is the easiest option and suits most workloads. The provider handles key security, but it also means the provider technically has access to decrypt your data if compelled (for example, by a legal order in their jurisdiction).

Customer-Managed Keys (CMK)

You generate and control your own keys, but store them in the provider's KMS. You decide the rotation schedule and can revoke access at any time. This gives you more control and proof of ownership — important for compliance with regulations like GDPR or HIPAA.

Customer-Provided Keys

You generate keys entirely outside the cloud provider's environment and supply them with each operation. The provider never stores them. This is the most complex option and is used only by organizations with strict data sovereignty requirements.

Key Rotation

Key rotation means replacing an old key with a new one on a schedule — monthly, quarterly, or annually. Rotating keys limits the damage if a key is ever compromised. An attacker who steals an old, rotated key cannot decrypt data encrypted with the newer key.

Think of it like changing the locks on your house every year. Even if someone copied your old key, it no longer works.

Hardware Security Modules (HSM)

A Hardware Security Module is a physical device designed specifically to generate and protect cryptographic keys. Keys inside an HSM never leave the device in plaintext. Cloud providers offer HSMs as a service (AWS CloudHSM, Azure Dedicated HSM, Google Cloud HSM) for organizations that need the highest level of key protection — typically required in financial services, healthcare, and government sectors.

Key Terms to Know

• KMS: Key Management Service — a managed cloud service for creating and controlling encryption keys.
• CMK: Customer-Managed Key — an encryption key you control within a cloud KMS.
• HSM: Hardware Security Module — a tamper-resistant physical device for storing and using cryptographic keys.
• Key Rotation: The process of replacing an existing key with a new one on a regular schedule.
• Key Revocation: Immediately disabling a key so it can no longer be used to encrypt or decrypt data.

What You Learned

Encryption keys must be actively managed throughout their lifecycle — creation, distribution, storage, use, rotation, revocation, and destruction. Cloud KMS services automate most of this. Keys should never be stored in code, plain text files, or alongside the data they protect. Customer-managed keys give you more control and help meet compliance requirements. Hardware security modules provide the strongest key protection for high-security environments.