Cyberstudy
PDF p.64 In progress

Key Management

Open PDF at p.64 12 flashcards

Summary

PDF p.64

Key management involves the operational considerations for managing cryptographic keys throughout their lifecycle, including key generation, storage, revocation, expiration, and renewal. Keys can be managed in a decentralized or centralized manner, with centralized key management often using dedicated servers and protocols like KMIP.

In plain words

Supplementary — not from your PDF

Keys have a lifecycle: create them properly, store them safely, revoke them if compromised, and renew or retire them on schedule. Keys can be managed on each machine (decentralized) or from a central key management system.

Detailed explanation

PDF p.64
  • Key Generation
    • Definition: Creates an asymmetric key pair or symmetric secret key of the required strength using the chosen cipher.
  • Storage
    • Purpose: Prevents unauthorized access to private or secret keys and protects against loss or damage.
  • Revocation
    • Definition: Prevents the use of a key if it is compromised. Encrypted data should be re-encrypted with a new key if the old key is revoked.
  • Expiration and Renewal
    • Purpose: Provides a "shelf-life" for certificates to enhance security. Certificates expire after a certain period and can be renewed with the same or a new key pair.
  • Decentralized Key Management
    • Model: Keys are generated and managed directly on the computer or user account that will use the certificate.
    • Advantages: Easy to deploy, no special setup required.
    • Disadvantages: Makes detection of key compromise more difficult.
  • Centralized Key Management
    • Model: Key generation and storage are centralized using a key management system.
    • Tools: Dedicated servers or appliances generate and store keys.
    • Protocol: Key Management Interoperability Protocol (KMIP) is used for communication between devices/apps and the server.

Important terms

taken from the text above
Key Generation
Creates an asymmetric key pair or symmetric secret key of the required strength using the chosen cipher.
Revocation
Prevents the use of a key if it is compromised. Encrypted data should be re-encrypted with a new key if the old key is revoked.
Model
Keys are generated and managed directly on the computer or user account that will use the certificate.
Protocol
Key Management Interoperability Protocol (KMIP) is used for communication between devices/apps and the server.
KMIP Key Management Interoperability Protocol

Examples & real-world scenarios

Supplementary — not from your PDF
  • A central key management server that devices talk to over KMIP.
  • Certificates with a one-year lifetime, renewed before expiry.
  • Re-encrypting data after a key is revoked.

Scenario

A company keeps finding expired certificates causing outages. It moves to centralized key management with renewal alerts, so it can see every key and certificate in one place.

Common mistakes

Supplementary — not from your PDF
  • Forgetting that data encrypted with a revoked key must be re-encrypted.
  • Assuming decentralized management is fine at scale. Compromises become harder to spot.

Practical skills

Supplementary — not from your PDF
  • Outline a key lifecycle policy.

What I should remember

Key Points PDF p.64
  • Key Generation
    • Creates: Asymmetric key pair or symmetric secret key.
    • Strength: Based on chosen cipher.
  • Storage
    • Prevents: Unauthorized access and loss/damage.
  • Revocation
    • Prevents Use: If key is compromised.
    • Re-encryption: Required for data encrypted with revoked key.
  • Expiration and Renewal
    • Shelf-Life: Enhances security.
    • Renewal: With same or new key pair.
  • Decentralized Key Management
    • Direct Management: On computer/user account.
    • Easy Deployment: No special setup.
    • Compromise Detection: More difficult.
  • Centralized Key Management
    • Centralized Storage: Using key management system.
    • Dedicated Servers: Generate and store keys.
    • KMIP: Protocol for communication.