Cryptographic Key Management Reference
Reference for key generation, storage, rotation, derivation, and lifecycle management best practices.
Key Lifecycle
Cryptographic keys follow a lifecycle: generation, activation, rotation, deactivation, and destruction. Keys must be generated using cryptographically secure random sources to ensure unpredictability. Rotation frequency depends on the threat model and data sensitivity. Destroyed keys must be securely erased from all storage media including memory.
- generation
- CSPRNG required
- rotation
- Periodic or event-driven
- destruction
- Secure erase, zero memory
crypto.getRandomValuescompromise triggerscrypto.zeroFreeStorage and Hierarchy
Keys should be stored in a hierarchy with a master key protecting data-encryption keys. Hardware security modules (HSMs) or trusted execution environments (TEEs) provide the strongest protection for root keys. Key derivation functions like HKDF derive multiple keys from a master secret. Separation of duties ensures no single person has access to all key material.
- HSM
- Hardware-protected key storage
- hierarchy
- Master -> DEK -> data
- HKDF
- Derive keys from master
FIPS 140-2/3envelope encryptionRFC 5869