Key Management Basics

Generation means a cryptographic random number generator: /dev/urandom, Windows CNG, Python secrets, openssl rand. Not time.time(), not math.random, not four words from a meme, not a screenshot of a dice site. Length depends on use: AES-256 wants 256 bits of key material; a password that will feed a KDF wants a long high-entropy passphrase stored in a manager, not reused from email. Symmetric keys and asymmetric key pairs are different objects: AES needs a shared secret stored like a password; RSA/ECDSA needs a private key that never leaves a controlled boundary and a public key you can publish. Separate keys per environment and service. The staging AES key is not the production AES key. The CI token is not the laptop admin password. Least privilege is easier when a leak of one toy-sized lab key cannot open the whole company — and in this course, a leak of a lab passphrase must not open your real accounts, which is why you will not reuse it.

Production stores: hardware security modules (HSM), cloud KMS, secret managers with IAM, OS keychains. Humans: a password manager. Local scripts: environment variables or a chmod 600 gitignored file — never the source tree you push. Public GitHub is not a vault. Slack is not a vault. A world-readable USB stick is not a vault. Encrypted offline backups of private keys beat “email myself the PEM.” Lost keys lock you out; leaked keys lock attackers in. Plan both. Rotation is changing the key before it is famous. Revocation is telling the world a key or certificate is dead (PKI you already met: CAs revoke; for API keys you disable the credential in the control plane). The plan must exist before the breach. If a live key ever lands in git, treat it as burned: rotate, purge history if you have a real incident process, never “it was only five minutes.” This course uses toy keys so you can practice the habit without burning a real tenant.

The Python snippet reads APP_MASTER_KEY from the environment. It does not embed a literal. For the lab, you may set a toy value in your shell for ten seconds, run a length check, then unset it — or skip execution and still write the pattern. openssl rand -hex 32 produces toy material; if you run it, do not paste the output into chat or git. The notes describe the lifecycle and the ethics line. They do not contain the hex.

mkdir -p "$HOME/cyberlium-lab"
NOTES="$HOME/cyberlium-lab/key-mgmt-notes.txt"

{
  echo "=== KEY MANAGEMENT LIFECYCLE ==="
  echo "generate: CSPRNG (openssl rand / Python secrets) — not clock, not memes"
  echo "store: KMS/HSM/secret manager (prod); password manager (humans); env or chmod 600 gitignored (local)"
  echo "use: least privilege — one key per service/environment"
  echo "rotate: on schedule and after suspicion"
  echo "revoke: disable burned credentials; renew certs before Not After"
  echo ""
  echo "code pattern: os.environ['APP_MASTER_KEY'] set OUTSIDE the repo — no literals"
  echo "ethics: never live keys in git/chat/screenshots; toy keys only; do not reuse lab passphrases on real accounts"
} > "$NOTES"

cat > "$HOME/cyberlium-lab/read_toy_key.py" << 'PY'
import os
key = os.environ.get("APP_MASTER_KEY")
if not key or len(key) < 32:
    raise SystemExit("fail closed: set a TOY APP_MASTER_KEY (>=32 chars) outside git, or skip running")
print("toy key length ok — not printing the secret")
PY

openssl rand -hex 32
export APP_MASTER_KEY='toy-only-not-a-real-secret-xxxx'  # local shell, then unset

chmod 600 "$NOTES" "$HOME/cyberlium-lab/read_toy_key.py"

You now treat keys as a lifecycle, not as a string that lives next to the code. Fail closed if the environment is empty. Rotate before the breach drill is real. Next — Lab — Encrypt & Verify a File — you will SHA-256 a toy file in cyberlium-lab, encrypt with OpenSSL AES using a lab passphrase you will not reuse, decrypt, and confirm the digest matches. chmod 600 everything that might hold that passphrase. Then the topic final quiz, and a honest tease of Topic 9 Ethical Hacking (CEH v13).