Advanced › Module 8 › Lesson 2
Key Storage
Key storage literacy — HSM, KMS, keystore, envelope encryption — never plaintext keys in repos on $CRYPTO_LAB reviews.
Visual · t28_key_storage
Key storage = named protection layers. $CRYPTO_LAB. Original Cyberlium.
Opening
Keys in plaintext repos become everyone keys — name storage layers defenders require before any crypto design review.
Key storage literacy: hardware security modules (HSM), cloud KMS (AWS KMS, GCP Cloud KMS category), OS keystores (Keychain, Keystore, DPAPI), envelope encryption (DEK wrapped by KEK), secrets managers, chmod 600 file hygiene for lab notes only — production keys never in git. Analyst reads architecture diagrams and $CRYPTO_LAB CTF flag writeups — maps hardcoded key findings to storage fix. Cyberlium on $CRYPTO_LAB code review of intentional vulnerable samples — recommend KMS/keystore paths, not exfiltration of real prod keys. Refused: scraping employer vault without authorization, publishing found API keys from prod repos, stealing HSM slots. Lab row: five storage options with threat blocked each.
1. Storage layers named
HSM, KMS, OS keystore, secrets manager, envelope encryption — five literacy anchors.
Lab notes chmod 600 — not a production key storage strategy.
Command guide
Try these commands — Storage layers named
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST key management — https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final CWE-522 — https://cwe.mitre.org/data/definitions/522.html (insufficiently protected credentials)
Optional command
OpenSSL — https://www.openssl.org/docs/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
cat > "$CRYPTO_LAB/notes/key-storage-literacy.txt" <<'EOF'
key storage best practices (literacy):
- generate with openssl rand / OS CSPRNG — never reuse lab passphrases in prod
- store private keys encrypted at rest (KMS/HSM/vault)
- chmod 600 on lab keys; rotate on compromise
- separate encryption keys from data encryption keys (DEK/KEK pattern)
never: commit keys, email keys, store prod keys in plaintext repos
EOFCommand — copy this
grep -E 'chmod 600|never|KMS' "$CRYPTO_LAB/notes/key-storage-literacy.txt"
python3 -c "print('Key storage literacy — lab keys stay in t28-crypto/keys/ only')"Primary tools to practice this lesson: grep, python3. Reference sites: NIST key management (https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final); CWE-522 (https://cwe.mitre.org/data/definitions/522.html); OpenSSL (https://www.openssl.org/docs/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender review points
Hardcoded keys in source, keys in env without rotation, world-readable key files — finding classes.
Fix maps to platform keystore or KMS — libraries-not-DIY Module 9.
3. Scope refuse
No exfiltration of prod keys; no unauthorized vault access.
Storage literacy supports architecture review — not theft.
4. What you ship: key storage option table
Five storage options + threat blocked + NEVER plaintext prod keys line.
5. What you record before the next lesson
Key storage option table path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Commit AES key to public GitHub repo as 'storage example.'
Right
Key storage table from $CRYPTO_LAB review. Next: Rotation Hygiene.
Mission: key storage option table
1) Name five storage options. 2) Threat blocked per option. 3) One hardcoded-key finding row. 4) Write NEVER plaintext prod keys line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Envelope encryption — DEK vs KEK?”
Knowledge Check
APPLY: Production keys should:
Multiple choice
Knowledge Check
APPLY: True or False: Hardcoded keys in source are acceptable.
True or False
Knowledge Check
APPLY: Envelope encryption wraps:
Multiple choice