What Is Key Management?
Key management is the discipline of handling cryptographic keys safely across their whole life — generation, storage, distribution, rotation, and destruction. It matters because encryption is only as strong as its keys: a flawless algorithm protects nothing if the key is weak, leaked, or hardcoded. In practice, most cryptographic breaches are key-management breaches.
What is the key lifecycle?#
A key passes through defined stages, each with its own risks:
- Generation — from a strong, random source.
- Distribution — getting the key where it is needed without exposing it.
- Storage — the hard part: keys must be usable by the system yet hidden from attackers.
- Rotation — replacing keys periodically to limit the damage of an undetected leak.
- Revocation & destruction — retiring compromised or expired keys securely.
The weakest link is usually storage. A key pasted into source code, a config file, or a container image is not managed — it is published to anyone who reads the repository.
How are keys protected in practice?#
| Approach | Protects against |
|---|---|
| Secrets manager (Vault, KMS) | Keys in code and config |
| Hardware security module (HSM) | Key theft even on a breached host |
| Key rotation | Long-lived exposure of one key |
| Separation of duties | A single person exfiltrating a key |
Key management is what makes PKI and encryption trustworthy in the real world. Its operational form is secrets management. More at the Security Fundamentals hub.
Frequently asked questions#
What is cryptographic key management?
Key management is the full lifecycle of handling cryptographic keys — generating, distributing, storing, rotating, and retiring them securely. Strong encryption is useless if the key is guessable, exposed in code, or never changed. Most real cryptographic failures are key-management failures, not broken algorithms.
What is a hardware security module (HSM)?
An HSM is a hardened, tamper-resistant device that generates and stores cryptographic keys and performs operations without the key ever leaving it. Applications ask the HSM to sign or decrypt; the key stays inside. This protects the most sensitive keys — like a certificate authority’s root — from theft even if servers are compromised.