Key Management Cheat Sheet

Revision as of 16:32, 15 April 2015 by Brian Russell (talk | contribs) (Algorithm Selection)

Jump to: navigation, search



This Key Management Cheat Sheet provides developers with guidance for implementation of cryptographic key management within application in a secure manner.

Key Management General Guidelines and Considerations

Algorithm Selection

Selection of the cryptographic and key management algorithms to use within a given application should begin with an understanding of the objectives of the application. For example, if the application is required to store data securely, then the developer should select an algorithm suite that supports the objective of Data-At-Rest (DAR) security. Applications that are required to transmit and receive data would select an algorithm suite that supports the objective of Data-in-Transit security. We have provided recommendations on the selection of crypto suites within an application based on application and security objectives.

Application developers oftentimes begin the development of crypto and key management capabilities by examining what is available in a library. However, an analysis of the real needs of the application should be conducted to determine the optimal key management approach. Begin by understanding the security objectives of the application which will then drive a determination of the cryptographic protocols that should be used.

For example, the objectives of the application may be: - Confidentiality of data at rest - Confidentiality of data in use - authenticity of data origin - authenticity of the end device - Integrity of data in transit - Confidentiality of data in transit

Once the understanding of the security needs of the application is achieved, developers can determine what protocols and algorithms are required. Once the protocols and algorithms are understood, you can you can begin to define the different types of keys that will need support the application's objectives. There are a diverse set of key types to consider, for example:

Encryption: - Symmetric encryption keys - Asymmetric encryption keys

Authentication of End Devices: - Pre-shared symmetric keys - Trusted certificates - Trust Anchors

Data Origin Authentication - HMAC

Integrity Protection - Message Authentication Codes (MACs)

Aside from the keys that the application supports, it will also likely be required to support certificates.

Authentication keys Key Encryption Keys (KEKs)

- Digital certificates - Asymmetric public key (and privates)


Key Strength




Memory Management Considerations

Perfect Forward Secrecy

Proxy Handling

Key Management Lifecycle Best Practices



EndPoint Authentication

Algorithms and Protools

Integrity and Confidentiality


Software-based Storage

Hardware Storage

Escrow and Backup

Key Escrow

Key Backup

Tracking and Audit

Key Compromise and Recovery

Trust Stores


Secure Update

Cryptographic Module Topics


Cryptographic Key Management Libraries

This article is focused on providing application security testing professionals with a guide to assist in managing cryptographic keys.

Authors and Primary Editors

Brian Russell - russellbri[at]

Drew Van Duren - drew.f.van.duren[at]

Other Cheatsheets

OWASP Cheat Sheets Project Homepage

This project is part of the OWASP Builders community.
Feel free to browse other projects within the Defenders, Builders, and Breakers communities.