Cryptography › Module 4 › Lesson 2
Key Management Basics
Generate, store, rotate, and revoke keys without leaving secrets in chat or git
Opening
Crypto fails open when keys wander
Brilliant algorithms cannot save a private key pasted into Slack. Key management is operational security: who can access secrets, how they are stored, and what happens when something leaks.
1. Practical Rules
Generate with strong randomness
Use OS/crypto library RNGs—not dice screenshots of “random” websites.
Store in proper vaults
HSM/KMS/secret managers for production; password managers for humans; env vars for local scripts.
Least privilege
Separate keys per environment and service.
Rotate & revoke
Plan for compromise drills before you need them.
Example — keep secrets out of codeimport os key = os.environ["APP_MASTER_KEY"] # set outside the repo assert len(key) >= 32
import os key = os.environ["APP_MASTER_KEY"] # set outside the repo assert len(key) >= 32
Backup private keys carefully
Encrypted offline backups beat “email myself the PEM.” Lost keys lock you out; leaked keys lock attackers in.
Knowledge Check
Best place for production API/crypto secrets?
Multiple choice
Knowledge Check
True or False: Key rotation planning should exist before a breach.
True or False
Knowledge Check
Least privilege for keys means:
Multiple choice