Key Lifecycle: Generate, Store, Rotate, Destroy
Define each phase of the cryptographic key lifecycle and its risks.
Key Lifecycle: Generate, Store, Rotate, Destroy is a free Cryptology Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cryptology Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Cryptographic Key Lifecycle
Every key passes through phases: generation → storage → distribution → use → rotation → archival → destruction. Failure at any phase can compromise all data protected by that key.
Phase 1: Key Generation
Keys must be generated from a cryptographically secure random source (CSPRNG). Key length must match algorithm requirements: AES-256, RSA-4096, ECDSA P-256, etc. Never derive keys from low-entropy sources.
Phase 2: Secure Storage
Keys at rest must be encrypted (key encryption key / KEK). Options: HSM, OS keychain (macOS Keychain, Windows DPAPI), cloud KMS, or encrypted file with strong passphrase. Never store plaintext keys in code or DB.
Phase 3: Key Distribution
Transport keys over TLS. Use key agreement (ECDH) rather than key transport where possible. Authenticate key recipients — a key delivered to the wrong party is a full compromise.
Phase 4: Key Usage
Limit key scope: one key per purpose (encryption ≠ signing ≠ MAC). Track key usage counters. Many standards (e.g., X9.42) define cryptoperiods — maximum time a key may be used.
Phase 5: Key Rotation
Rotate keys before their cryptoperiod expires, after a suspected compromise, or after personnel changes. Re-encrypt data under the new key or use envelope encryption so only the KEK rotates.
Envelope Encryption Pattern
Encrypt data with a random data encryption key (DEK). Encrypt the DEK with a key encryption key (KEK) stored in KMS. To rotate: re-encrypt only the DEK, not all the data.
import os
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
# Generate a fresh DEK for each data blob
dek = os.urandom(32)
aesgcm = AESGCM(dek)
nonce = os.urandom(12)
ciphertext = aesgcm.encrypt(nonce, b"sensitive data", None)
# DEK is then encrypted by KEK (stored in KMS) before persistencePhase 6: Archival
Some keys must be archived for decryption of old data (long-term backup keys). Archived keys are stored offline, air-gapped, often on hardware tokens with m-of-n custodian access.
Phase 7: Destruction
Key destruction must be cryptographically secure: overwrite memory, destroy HSM key slots, shred physical media. Certificate revocation is the PKI equivalent of key destruction for public keys.
Key Compromise Response
If a key is suspected compromised: immediately revoke/CRL-publish, rotate to a new key, re-encrypt all affected data, audit logs for unauthorised use, notify affected parties per breach regulations.
Knowledge Check
What is the primary advantage of envelope encryption for key rotation?
Lesson Recap
Key lifecycle spans 7 phases from generation to destruction. Envelope encryption separates DEK (data encryption) from KEK (key management) enabling efficient rotation. Destruction must be cryptographically secure. Compromise response must be immediate and audited.
Frequently asked questions
Is the “Key Lifecycle: Generate, Store, Rotate, Destroy” lesson free?
Yes — the full text of “Key Lifecycle: Generate, Store, Rotate, Destroy” is free to read here on the web, and the Cryptology Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cryptology Academy course, upgrade to CoddyKit PRO.
What will I learn in “Key Lifecycle: Generate, Store, Rotate, Destroy”?
Define each phase of the cryptographic key lifecycle and its risks. You practise Cryptology Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cryptology Academy?
No prior experience is required. Cryptology Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Key Lifecycle: Generate, Store, Rotate, Destroy” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cryptology Academy lesson?
Yes. Every Cryptology Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Key Lifecycle: Generate, Store, Rotate, Destroy
- HSM Architecture & PKCS#11 Interface
- AWS KMS, GCP Cloud KMS & Azure Key Vault
- Key Escrow, Backup & Recovery Procedures