Secure Coding & OWASP Top 10 for Backend · Lesson

Key Management and Hashing

Explore secure practices for managing encryption keys, using strong hashing algorithms for passwords, and avoiding common cryptographic pitfalls.

Key Management and Hashing is a free Secure Coding & OWASP Top 10 for Backend lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Secure Coding & OWASP Top 10 for Backend learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Intro to Cryptographic Keys

Welcome to this lesson on Key Management and Hashing! We'll explore how to protect the secrets that protect your data.

Cryptographic keys are fundamental to secure communication and data storage. Think of them as secret passwords or unique stamps that lock and unlock sensitive information.

Why Key Security Matters

The security of your entire system often depends on the security of your cryptographic keys.

Data Breaches: If an attacker gains access to your encryption keys, all data encrypted with those keys becomes readable.
Impersonation: Compromised signing keys can allow attackers to forge identities or tamper with data without detection.
Trust Erosion: Loss of keys can lead to a complete breakdown of trust in your system's security posture.

Generating Strong Keys

Keys must be truly random and sufficiently long to be secure. Weak or predictable keys are easy for attackers to guess.

Always use cryptographically secure random number generators (CSRNGs) provided by your programming language's standard library. Never roll your own!

Try running this example to see how a secure key can be generated:

import java.security.SecureRandom;
import java.util.Base64;

public class KeyGenerator {
  public static void main(String[] args) {
    SecureRandom random = new SecureRandom();
    byte[] keyBytes = new byte[32]; // 256-bit key
    random.nextBytes(keyBytes);
    String base64Key = Base64.getEncoder().encodeToString(keyBytes);
    System.out.println("Generated Key: " + base64Key);
  }
}

Secure Key Storage

Once generated, keys need to be stored securely. This is one of the most critical aspects of key management.

Hardware Security Modules (HSMs): Dedicated physical devices for secure key generation, storage, and cryptographic operations.
Key Management Services (KMS): Cloud-based services (e.g., AWS KMS, Azure Key Vault) that provide secure key storage and lifecycle management.
Avoid: Storing keys directly in source code, configuration files, or version control.

Key Rotation for Longevity

Even with the best storage, keys can eventually be compromised. Regular key rotation limits the damage if a key is ever exposed.

Key rotation involves generating a new key, re-encrypting data with the new key, and securely archiving or destroying the old key. This reduces the 'window of exposure' for any single key.

Understanding Hashing

Hashing is a one-way process that transforms input data into a fixed-size string of characters, called a hash or digest.

One-way: You can't easily reverse a hash to get the original data.
Fixed-size: No matter the input size, the output hash is always the same length.
Unique (mostly): A tiny change in input results in a vastly different hash.

Hashing is crucial for verifying data integrity and securely storing passwords.

Hashing Passwords Securely

Never store user passwords in plain text or encrypted form. Always store their hash.

If a database is breached, attackers only get hashes, not the actual passwords. Since hashing is one-way, they can't easily recover the original passwords.

However, simple hashing isn't enough on its own. We need more techniques!

The Power of Salting

A salt is a unique, random string added to a password before it's hashed. Each user gets a different salt.

Salting prevents rainbow table attacks, where attackers pre-compute hashes for common passwords. With salts, even if two users have the same password, their stored hashes will be completely different.

This example conceptually shows how a salt is added before hashing:

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.util.Base64;

public class PasswordHasher {
  public static void main(String[] args) throws NoSuchAlgorithmException {
    String password = "mySecretPassword";
    
    // Generate a random salt for each user
    SecureRandom random = new SecureRandom();
    byte[] saltBytes = new byte[16]; // 128-bit salt
    random.nextBytes(saltBytes);
    String salt = Base64.getEncoder().encodeToString(saltBytes);
    
    // Combine password and salt, then hash
    String saltedPassword = password + salt;
    MessageDigest md = MessageDigest.getInstance("SHA-256"); // Illustrative
    byte[] hashedPasswordBytes = md.digest(saltedPassword.getBytes());
    String hashedPassword = Base64.getEncoder().encodeToString(hashedPasswordBytes);
    
    System.out.println("Password: " + password);
    System.out.println("Salt: " + salt);
    System.out.println("Hashed Password (with salt): " + hashedPassword);
  }
}

Modern Hashing Algorithms

For password hashing, don't use general-purpose hash functions like SHA-256 or MD5. They are too fast, making brute-force attacks easier.

Instead, use algorithms specifically designed to be slow and computationally intensive:

Bcrypt: Widely used and highly recommended.
Scrypt: Another strong option, especially resistant to GPU-based attacks.
Argon2: The winner of the Password Hashing Competition, considered state-of-the-art.

These algorithms have adjustable 'work factors' to increase their computational cost over time.

Avoiding Crypto Pitfalls

Cryptography is complex. Common mistakes can severely weaken your security:

Don't 'Roll Your Own' Crypto: Always use well-vetted, standard cryptographic libraries. Custom implementations are almost always insecure.
Hardcoding Keys: Never embed encryption keys directly in your code.
Using Weak Algorithms: Avoid deprecated or known-vulnerable algorithms (e.g., MD5, SHA1 for security, DES, RC4).
Improper Randomness: Don't use non-cryptographically secure random number generators for security tasks.

Test Your Knowledge

Which of the following are recommended best practices for managing cryptographic keys and passwords?

Recap & Next Steps

In this lesson, we've covered the vital aspects of cryptographic key management and secure password hashing.

Keys: Generate strong, random keys, store them securely (HSM/KMS), and rotate them regularly.
Hashing: Always hash passwords using unique salts and slow, purpose-built algorithms like bcrypt, scrypt, or Argon2.
Avoid Pitfalls: Never create your own crypto, hardcode keys, or use weak algorithms.

By following these practices, you significantly strengthen your backend applications against data breaches and unauthorized access. Keep learning and stay secure!

Frequently asked questions

Is the “Key Management and Hashing” lesson free?

Yes — the full text of “Key Management and Hashing” is free to read here on the web, and the Secure Coding & OWASP Top 10 for Backend course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Secure Coding & OWASP Top 10 for Backend course, upgrade to CoddyKit PRO.

What will I learn in “Key Management and Hashing”?

Explore secure practices for managing encryption keys, using strong hashing algorithms for passwords, and avoiding common cryptographic pitfalls. You practise Secure Coding & OWASP Top 10 for Backend with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Secure Coding & OWASP Top 10 for Backend?

No prior experience is required. Secure Coding & OWASP Top 10 for Backend on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Key Management and Hashing” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Secure Coding & OWASP Top 10 for Backend lesson?

Yes. Every Secure Coding & OWASP Top 10 for Backend lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Secure Coding & OWASP Top 10 for Backend