Cryptography · Cluster
Key Management
Generation, rotation, and storage.
- 01 Entropy Sources and the Path from Randomness to a Key Why a generated key is capped by the entropy behind it, how kernel pools and deterministic generators condition that entropy, and where the path breaks.
- 02 Envelope Encryption and the Two-Level Key Hierarchy Why bulk data is encrypted under a per-object data key wrapped by a long-lived master key, and what the indirection buys and costs.
- 03 Password-Based Key Derivation and What Iteration Counts Buy How salts, memory hardness, and iteration counts change the cost of guessing a password-derived key, and where each parameter stops helping.
- 04 Protecting Key Material in Memory and at Rest What page locking, guard pages, and zeroization actually prevent, why memory safety languages change the calculus, and where stored keys leak.
- 05 Key Rotation, Key Versions, and Why Re-Encryption Is Optional How versioned keys and wrapped data keys let a system rotate without rewriting ciphertext, and when that shortcut stops being safe.
- 06 What an HSM Boundary Actually Guarantees Which properties a hardware security module enforces, which it merely reports, and how key operations move across the boundary without exposing keys.
- 07 Transporting a Key Versus Agreeing on One Key transport and key agreement solve the same problem with different assumptions about who holds what, and differ in what a compromise of one party yields.
- 08 Threshold Secret Sharing and Why t of n Beats Two Copies Shamir sharing over a finite field, the arithmetic that makes any t shares sufficient, and the difference between hiding a key and requiring several parties to use it.
- 09 Key Destruction, Retired Keys, and Cryptographic Erasure Why deleting a key is not the same as destroying it, what media retain after overwrite, and how destroying a wrapping key deletes data it never touched.
- 10 Designing a Key Service Interface That Cannot Be Misused Why a key store should expose operations rather than keys, which parameters belong in a request, and how context binding and audit change the trust model.