<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-key-management
description: >-
  Design and operate cryptographic key management systems covering key lifecycle
  (generation, storage, rotation, destruction), envelope encryption, KMS
  integration (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault),
  key wrapping, and compliance with NIST SP 800-57.
domain: cybersecurity
subdomain: cryptography
tags:
  - key-management
  - kms
  - vault
  - envelope-encryption
  - key-rotation
  - key-generation
  - nist-800-57
  - aws-kms
  - azure-key-vault
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1552.004"]
---

# Implementing Key Management

## Overview

Cryptographic key management is the hardest part of applied cryptography.
Keys must be generated with sufficient entropy, stored with access controls,
rotated on schedule, and destroyed completely when no longer needed. This skill
covers the full key lifecycle across cloud KMS platforms and self-hosted vaults.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| AWS CLI | `pip install awscli` |
| Azure CLI | `curl -sL https://aka.ms/InstallAzureCLIDeb \| sudo bash` |
| HashiCorp Vault | `brew install vault` / binary release |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Key Lifecycle (NIST SP 800-57)

```
1. Generation    → CSPRNG, appropriate algorithm/length
2. Registration  → Catalog in key inventory with metadata
3. Distribution  → Secure transport (TLS, key wrapping)
4. Storage       → HSM, KMS, or encrypted key store
5. Use           → Enforce purpose constraints (encrypt-only, sign-only)
6. Rotation      → Scheduled re-key, retain old for decryption
7. Archival      → Read-only access for compliance/recovery
8. Destruction   → Cryptographic erasure, audit log entry
```

### Key Generation

```bash
# AES-256 symmetric key
openssl rand -hex 32

# RSA-4096 asymmetric key
openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:4096 -out rsa.pem

# ECDSA P-256 key
openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out ec.pem

# Ed25519 signing key
openssl genpkey -algorithm ed25519 -out ed25519.pem

# Verify entropy source
cat /proc/sys/kernel/random/entropy_avail
```

### Envelope Encryption Pattern

```
┌─────────────────────────────────────────┐
│ Data Encryption Key (DEK)               │
│  ├── Random 256-bit key                 │
│  ├── Encrypts actual data (AES-GCM)     │
│  └── Stored encrypted alongside data    │
├─────────────────────────────────────────┤
│ Key Encryption Key (KEK)                │
│  ├── Stored in KMS / HSM                │
│  ├── Wraps (encrypts) the DEK           │
│  └── Never leaves KMS boundary          │
├─────────────────────────────────────────┤
│ Rotation: Re-wrap DEKs with new KEK     │
│  └── No re-encryption of actual data    │
└─────────────────────────────────────────┘
```

### Cloud KMS Operations

```bash
# AWS KMS — create key
aws kms create-key --description "App encryption key" \
  --key-usage ENCRYPT_DECRYPT --key-spec SYMMETRIC_DEFAULT

# AWS KMS — encrypt data
aws kms encrypt --key-id alias/app-key \
  --plaintext fileb://data.bin --output text --query CiphertextBlob

# AWS KMS — enable automatic rotation
aws kms enable-key-rotation --key-id <key-id>

# Azure Key Vault — create key
az keyvault key create --vault-name myVault --name app-key \
  --kty RSA --size 4096

# GCP Cloud KMS — create key ring and key
gcloud kms keyrings create app-ring --location global
gcloud kms keys create app-key --keyring app-ring --location global \
  --purpose encryption --rotation-period 90d
```

### HashiCorp Vault

```bash
# Enable transit secrets engine
vault secrets enable transit

# Create encryption key
vault write -f transit/keys/app-key type=aes256-gcm96

# Encrypt data
vault write transit/encrypt/app-key plaintext=$(echo -n "secret" | base64)

# Rotate key (creates new version, old versions decrypt)
vault write -f transit/keys/app-key/rotate

# Set minimum decryption version (destroy old versions)
vault write transit/keys/app-key/config min_decryption_version=2
```

## Workflow

1. **Inventory** — Catalog all cryptographic keys, their purpose, and location
2. **Classify** — Assign sensitivity level and compliance requirements
3. **Migrate** — Move keys from files/env vars to KMS/Vault
4. **Automate** — Configure automatic rotation schedules
5. **Monitor** — Alert on key expiry, unauthorized access, rotation failures
6. **Audit** — Regular review of key usage and access logs

## Verification

| Check | Method |
|---|---|
| Keys in KMS/HSM | No plaintext keys on filesystem or in env vars |
| Rotation enabled | AWS: `aws kms get-key-rotation-status`, Vault: key version > 1 |
| Entropy adequate | `/proc/sys/kernel/random/entropy_avail` > 256 |
| Access logged | KMS CloudTrail / Vault audit log enabled |
| Separation of duty | Key admin ≠ key user IAM roles |

## References

- [NIST SP 800-57 Part 1 Rev. 5](https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final)
- [AWS KMS Developer Guide](https://docs.aws.amazon.com/kms/latest/developerguide/)
- [HashiCorp Vault Transit Engine](https://developer.hashicorp.com/vault/docs/secrets/transit)
- [Azure Key Vault Documentation](https://learn.microsoft.com/en-us/azure/key-vault/)
