5 Cryptographic Key Management Free Online FlashCards

Why use separate keys for different cryptographic purposes?

Use separate keys for different purposes; for example, do not reuse a data-encryption key for digital signatures.

What belongs in a key inventory, and what must it exclude?

Record each key’s identifier, type, purpose, owner, location, status, creation date, and rotation or expiration schedule. Never include the secret key material.

Which cryptographic operation does not require key lifecycle controls?

A cryptographic hash function such as SHA-256 does not use a key. Keyed MACs, symmetric encryption, and digital-signature systems do use key material.

How should cryptographic keys be generated?

Use a cryptographically secure random-number generator from a trusted cryptographic library or module. Do not invent keys, reuse passwords, or modify existing keys.

Which part of a public-key pair requires protection?

Protect the private key. The corresponding public key can generally be distributed openly.

Where should application keys be stored?

Store keys in a key vault, HSM, or other protected key-management system—not in source code, version control, container images, or ordinary configuration files.

In envelope encryption, what are the roles of the DEK and KEK?

A DEK encrypts the data; a separately protected KEK encrypts or wraps the DEK.

What does least privilege mean for key access?

Give each person, service, or workload only the key permissions it needs.

Why might backing up a private signing key be unsafe?

Back up a key only when recovery is necessary and permitted. Avoid backing up or escrowing private signing keys unless policy explicitly allows it, because copies increase exposure and can weaken control over signing.

What is a key’s cryptoperiod?

A cryptoperiod is the period during which a key is authorized for use. Rotation rules should account for purpose, data sensitivity, usage volume, threat model, and system requirements.

What data operation is generally needed when replacing a KEK versus a DEK?

Replacing a KEK often requires re-wrapping DEKs. Replacing a DEK for existing data generally requires re-encrypting that data.

How can a system migrate encrypted data to a new key?

A system may use the new key for new writes while temporarily retaining the old key for reads. Keep the old key only as long as needed for authorized recovery or access.