Encryption Key Management

Encryption key management is the process of protecting and storing encryption keys through usage policies, encryption, generation, and destruction. Not only do enterprises need to encrypt sensitive data, but they also need to protect the encryption keys that decrypt that data. Protection measures can include using encryption keys to protect other encryption keys (multiple layers of encryption), key management systems or software, and backing up keys properly. Encryption key management must meet the demands of scaling to protect ever-increasing amounts of data as well as legal demands for key management, such as appropriate security precautions and compliance regulations.

Encryption keys should only be used for a determined period of time, which depends on the sensitivity of the data they protect. The more security that’s needed, the shorter a key’s life becomes. A key’s lifespan is known as its crypto period. Keeping a key active for an overly long period of time is dangerous; it allows more opportunity for someone to gain unauthorized access to it. Part of encryption key management is generating new keys, cycling old ones out, and eventually destroying them.

Key management software is available for the cloud, but another common method of key management is the hardware security module (HSM), which stores encryption keys in a physical module. HSM-as-a-Service is another option – it provides a combination of cloud and hardware key management and storage.

The Payment Card Industry Data Security Standard (PCI DSS) requires that organizations protect customer data and encrypt it in certain cases. Encryption key management can help businesses comply with those standards because it protects data, makes regular changes to encryption keys, and backs keys up.

Key management API

A key management application program interface (API) performs key management and key usage functions. Key management involves storing, creating, and destroying encryption keys; usage involves managing permissions, decryption, and authorization/authentication – transferring keys to the appropriate user when requested. Large cloud providers will have request forms or codes available (on their website, for example) so that users can submit an access request for their key.

Webopedia Staff
Webopedia Staff
Since 1995, more than 100 tech experts and researchers have kept Webopedia’s definitions, articles, and study guides up to date. For more information on current editorial staff, please visit our About page.

Top Articles

List of Windows Operating System Versions & History [In Order]

The Windows operating system (Windows OS) refers to a family of operating systems developed by Microsoft Corporation. We look at the history of Windows...

How to Create a Website Shortcut on Your Desktop

Website Shortcut on Your Desktop reviewed by Web Webster   This Webopedia guide will show you how to create a website shortcut on your desktop using...

What are the Five Generations of Computers? (1st to 5th)

Reviewed by Web Webster Each generation of computer has brought significant advances in speed and power to computing tasks. Learn about each of the...

Hotmail [Outlook] Email Accounts

Launched in 1996, Hotmail was one of the first public webmail services that could be accessed from any web browser. At its peak in...

AutoLocky Ransomware

AutoLocky is ransomware written in the popular AutoIt scripting language. It uses strong...

Data Governance

Data governance is a term used to refer to the management of processes,...

Capacity Planning

Capacity planning is a process that helps organizations determine the resources needed to...