Encrypting Imposter Syndrome

The blog will serve as a note taking medium for my cramming/learning/studying for a encryption role. GL HF!

• Why are crypto keys important?

  They are the foundation of encrypting sensitive data, authenticating users and devices, and ensuring the integrity of communication channels.

• Integrate key management processes early in DevOps lead to a more secure and efficient pipeline

• Key management is not just a security measure but a compliance mandate for PCI DSS, GDPR, and/or HIPAA

• The Key Management Lifecycle (KML) comprises of several stages that will help effectively manage crypto keys

• KML is a.k.a. cryptoperiod

---

Key Life Cycle

1. Key Generation

   • Creating secure and compliant keys means guaranteeing their strength and their randomness

2. Key Distribution

   • This stage involves securely transmitting keys, ensuring they are not intercepted or compromised, to the intended users and systems

3. Key Storage

   • Secure storage employs encrypted databases or specialized hardware security modules (HSMs)

   • Effective storage also includes access controls and audit logs to ensure only authorized entities can access the keys

4. Key Usage

   • This phase is to monitor and control the how, when, and by whom the key are used

   • Prevents unauthorized usage

5. Key Backup & Recovery

   • Creating secure copies of crypto keys to avoid losing access to keys in case of deletion or corruption

6. Key Rotation

   • Replaces old keys wiht new ones at regular intervals or in response to specific events

7. Key Revocation

   • Process of invalidating a key before its schedule expiration

   • Necessary when keys are compromised, the user is no longer authorized, or the key is suspected to be exposed to unauthorized access

8. Key Destruction

   • When a key is no longer needed or its lifecycle has ended it’s destroyed to ensure it cannot be recovered or used

   • Destruction is safely deleting the key due to the expiration/end of the cryptoperiod assigned

   • Sometimes archiving is necessary over destruction

   • Purge periods are set so that when you delete a key you can still retrieve it after x amount of days before full deletion

---

Best Practices

1. For key generations…

   • Use strong Random Number Generators (RNGs) in Key Generation

     • Check FIPS-140 for RNG algorithms

   • Use industry standards for generation algorithms and key lengths

     • Check NIST for key algorithms

   • Ensure key generation environment is secure

     • Use HSMs to provide tamper-proof environments for generation, storage and management

   • Validate all parameters of key generation

     • Verify the randomness source, algorithm configurations, and key length are appropriate for the intended use

   • Option 1: Bastion Host in the Cloud

     • Isolated jump servers that have no internet access

     • Only accessible through ssh keys and MFA

     • Security hardened box

   • Option 2: Generate Directly in Secure Storage Solutions

     • Directly generated in the vault

     • Azure Key Vault and HashiCorp Vault comply with security standards and regulations already

     • Built with KLM in mind to have key rotations, revocation, or destruction features available

2. For key distributions…

   • Use secure protocols

     • Protocols like TLS (Transport Layer Security) and mTLS (mutual TLS) can transmission of keys over networks

   • Employ PKI

     • Public Key Infrastructure

     • Utilizing public and private keys to distribute key usage

   • Use trusted delivery methods

     • Encrypted emails, encrypted file exchanges, SFTP

   • Implement trust but verify

     • Before transmitting verify the identity of the receiving party

   • Provide secure storage solutions

     • Educate and equip the recipients with the tools and knowledge to store keys

   • Option 1: symmetric key distributions

   • Option 2: asymmetric key distributions

   • Option 3: key distribution centers

     • secure and centralized system that distributes keys to communicating parties

   • Option 4: pre-shared keys

     • used in scenarios where a restricted number of parties require secure communications

3. For key storage…

   • HSMs are physical devices that are designed to generate, store, and manage cryptographic keys securely

     • Offer tamper-resistant hardware that securely handles key generation, encryption, decryption, and signing operations

   • Cloud-based key management services

     • AWS KMS, Azure Key Vault, Google Cloud KMS

       • Scalable, high availability, and built-in compliance