cryptographic-key-management-pattern

name	cryptographic-key-management-pattern
description	Security pattern for managing cryptographic keys throughout their lifecycle. Use when integrating cryptography requiring key generation, storage, distribution, or usage. Provides guidance on key confidentiality, integrity, configuration protection, and key information handling. Foundation for Cryptography as a service and Self-managed cryptography patterns.

Cryptographic Key Management Security Pattern

When integrating cryptographic primitives into a system, correctly managing cryptographic keys is a crucial aspect. This pattern encapsulates common issues when applying solutions involving cryptography.

Importance

Proper key management is one of the most crucial aspects when applying cryptography.

Any security guarantees provided by a cryptosystem can be nullified if an attacker can obtain or tamper with the used cryptographic key(s).

Example: An attacker that obtains a supposedly secret session key will be able to decrypt all messages encrypted with that key.

Key Security Requirements

In most circumstances, cryptographic keys should be:

1. Kept confidential throughout their lifecycle
2. Have their integrity protected throughout their lifecycle

Exception: For some types of keys, such as the public key in an asymmetric key pair, the confidentiality requirement can be relaxed (but integrity must still be protected).

Core Components

Role	Type	Responsibility
Entity	Entity	Wants to generate and use cryptographic keys
Cryptographer	Cryptographic Primitive	Library generating keys and performing cryptographic actions