A key management system is a solution that manages the cryptographic keys in a cryptosystem. Think of it as the cabinet where a hotel stores all the room keys. It’s where the receptionist obtains the key to your room so he or she can hand it over to you once you’ve completed the check-in process.
Unlike the hotel’s key cabinet, however, which you can see physically, the key management system we’ll talk about in this post exists virtually—inside your computer.
Other interesting terms…
Read More about “Key Management System”
You probably noticed that the definition of a key management system we gave above isn’t that simple. To better understand what it is, you’ll need to learn some cryptography basics first.
What Cryptographic Concepts Should You Know to Answer “What Is a Key Management System”?
We defined the terms you should know below.
- Cryptography: This term was derived from the Greek word kryptos, meaning “hidden.” It is the study of secure communication techniques that let only a message’s sender and intended recipient view its contents. The communication thus remains hidden or secret from anyone else.
- Cryptosystem: This is a structure or scheme comprising algorithms that convert plaintext to ciphertext to encode or decode messages securely. It is a means to encrypt and decrypt a message by turning what everyone can read into a secret code.
- Cryptographic key: This refers to a data string that locks and unlocks cryptographic functions, namely authentication, authorization, and encryption. You can liken it to random characters inserted into a message to render it unreadable to unauthorized recipients.
- Encryption: This is the process of applying a cryptographic key to the message to render it unreadable to unauthorized recipients. The type of encryption you use determines what kind of key you need to use. You’ll learn about that later.
- Decryption: This refers to the process of using a cryptographic key to return an encrypted message into its plaintext version so the intended recipient can read it.
What Are the Different Types of Keys Used by a Key Management System?
There are two types of keys in a key management system—symmetric and asymmetric. Let’s distinguish one from the other.
- Symmetric key: When you use a symmetric key algorithm, you’ll need a single key to encrypt and decrypt a message. Choosing this encryption mode requires choosing, distributing, and keeping the key as securely as possible.
- Asymmetric key: Also known as a “public key,” using this algorithm requires two distinct keys that are mathematically linked. One can’t function without the other. This type of encryption also requires a private key and digital certificates for the two keys. The public and private key pair and their digital certificates can be obtained from an authorized public key infrastructure (PKI). The sender encrypts the message with the public key while the recipient decrypts it with the private key. The public key may be known to many. The security lies in keeping the private key secret.
Using the two kinds of keys has varying requirements, summed up in the table below.
You can learn more about public and private keys in this guide.
How Does a Key Management System Work?
There are eight critical steps in the key management system life cycle. These are:
- Generation: This step requires using a key generator, an encryption algorithm, or a random number generator. Your chosen key generator may determine its security. Attackers can easily crack weakly encrypted keys. Once they discover the value of the encryption key, they can read your encoded messages. As the comparison table above shows, you can choose from several ciphers, depending on the type of key you want to use.
- Distribution: This step shares the key/s to the users via a secure Transport Layer Security (TLS) or Secure Sockets Layer (SSL) connection. Using an insecure connection may affect the safety of the keys, as attackers can execute man-in-the-middle (MitM) attacks and steal the keys during transport.
- Use: This step is where the decryption key is actually used.
- Storage: If a key is meant to decrypt data, it must be stored in a secure location, such as a Hardware Security Module (HSM) or CloudHSM. If an HSM or CloudHSM is unavailable, you can keep it in a secure computer or use your cloud service provider’s key management service.
- Rotation: Once a key’s cryptoperiod expires, or it can no longer be used, the key must be rotated. It gets retired and replaced with a new key. Rotation is necessary because the longer a key is in use, the more likely someone unauthorized can steal it or find out what it is.
- Backup/Recovery: If a key gets lost, you can access the storage to retrieve it.
- Revocation: This is one way to deal with a compromised key. Revoking entails disallowing the key’s use to encrypt or decrypt data even if its cryptoperiod is still valid.
- Destruction: This is another way to deal with a lost or stolen key. Destroying means deleting the key permanently from any key manager database or other storage devices. That makes it impossible to recreate the key unless a backup image is available.
The following diagram sums up the steps in the life cycle of a key management system.
—
A key management system has become critical for confidential organizational communication. Without its use, transmitting data that should not be seen by other users apart from the intended recipient is not possible.
