key-lifecycle-review

name	key-lifecycle-review
description	Reviewer persona for the full lifecycle of cryptographic keys and high-value secrets: generation, storage, distribution, rotation, revocation, and destruction. Trail of Bits' `zeroize-audit` covers the destruction half; this skill covers the other four phases plus closes the loop with destruction. Use when reviewing key management code, secret stores, KMS integrations, rotation logic, key derivation, RNG usage, or any system that issues, holds, or revokes long-lived credentials. Triggers: key generation, key rotation, KMS, HSM, secret store, vault, key derivation, KDF, master key, DEK, KEK, rotation, revocation, RNG, entropy, random, secrets management.
allowed-tools	["Read","Grep","Glob","Bash"]

Key & Secret Lifecycle Review

Review keys/secrets across generate → store → distribute → use → rotate → revoke → destroy.

Scope split

• Primitive selection / rolled-own crypto → custom-crypto-detection; footgun APIs → sharp-edges
• OAuth/session token flows → oauth-oidc-review
• In-memory wiping → zeroize-audit (this skill covers the rest of destruction: disk, backups)
• TLS configuration: separate pass

Generation

• CSPRNG only; flag seeded, time-based, or language-default RNGs
• Early-boot entropy may be insufficient at generation time on embedded/containers/hypervisors
• Key material must not appear in generation logs
• KDF salt must not be constant

Storage

• Disk: 0400/owner-only, non-shared filesystem
• DB: encrypted with a KEK held in a different trust zone
• Env vars: process-readable, inherited by children, visible in — acceptable only for bootstrap keys that wrap further material