What is Key Management?
Also called KMS, Cryptographic Key Management.
Key management is the set of practices governing how cryptographic keys are generated, stored, distributed, rotated, revoked and destroyed. Because encryption transfers the security of data onto the security of its keys, key management is the control that determines whether encryption provides real protection or only satisfies a checklist.
Keys are normally held in a dedicated key management service or a hardware security module, which performs cryptographic operations without releasing key material to calling applications. Envelope encryption is the standard pattern: a data key encrypts the content, a master key encrypts the data key, and rotating the master key requires re-encrypting only the small wrapped keys rather than entire datasets.
Access to keys is separated from access to data on purpose. If the same identity can read the ciphertext and use the key, encryption adds little against a compromise of that identity. Mature setups apply least privilege to key usage, separate the roles that manage keys from those that use them, and log every operation so key use can be reconstructed during an investigation.
Rotation and revocation need to work before they are needed. Regular rotation limits how much data any single key protects and exercises the mechanism so it is not first attempted during an incident. Revocation requires knowing what a key protected, which in turn requires an inventory. Destruction is also a privacy tool: cryptographic erasure deletes a key so its ciphertext becomes unrecoverable.
Customer managed key arrangements, sometimes called bring your own key, let a customer supply and control the keys protecting their data, including the ability to revoke access. They are frequently requested in regulated procurement. They also shift operational risk, since a customer revoking or losing a key renders the corresponding data unusable by design.
Key points
- Encryption is only as strong as key storage and access control
- Use a key service or hardware module, not application config
- Envelope encryption makes rotation practical
- Separate the roles that manage keys from those that use them
- Cryptographic erasure deletes data by destroying its key
In practice
A platform stores integration credentials encrypted with per tenant data keys, each wrapped by a master key in a managed key service. Application servers can request decryption but never see the master key, and every request is logged with the calling identity. When a tenant offboards, the team deletes that tenant's data key, which renders the remaining ciphertext unrecoverable even where it survives in aged backups.