Home › Security Architecture & Engineering

Key Management Explained — Cryptography (Part 6)

Security Architecture & EngineeringCISSPSecurity+

Cryptography is only as strong as the keys: length plus randomness, then generate, store, rotate, and destroy. In Part 6 of our Cryptography series, we cover TPMs and HSMs, KEKs wrapping DEKs, separation of duties vs dual control vs split knowledge, and why keys get rotated.

What you will learn

• The cryptographic lifecycle — type, algorithm, key length, mode; data at rest, in transit, in use
• Why strength is length plus randomness
• Hardware RNGs in TPMs and HSMs, and wrapping a data key with a key-encryption key
• Separation of duties, dual control, and split knowledge — related, not the same
• When and why to rotate keys (NIST / PCI: data-encryption keys at least annually)
• How to destroy a retired key so it cannot be recovered
• Why AES-128 is the shortest key length you should use against trying every key, and what happened to DES in 1999

Part of the series: Cryptography Explained — Overview (Part 1)

1. Cryptography Explained — Overview (Part 1)
2. Symmetric Encryption Explained — Cryptography (Part 2)
3. Asymmetric Encryption Explained — Cryptography (Part 3)
4. Hashing Explained — Cryptography (Part 4)
5. PKI Explained — Cryptography (Part 5)
6. Key Management Explained — Cryptography (Part 6)
7. Cryptanalytic Attacks Explained — Cryptography (Part 7)

More in Security Architecture & Engineering

• Security Models Explained — Overview (Part 1)
• Secure Access Service Edge (SASE) Explained