Key Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
summary
Explains concrete key practices: DEK wrapped by KEK for envelope encryption, HSM-backed key stores versus software/secrets managers, and cloud choices (platform-managed vs customer-managed KMS) with integration and exportability as hard requirements. Calls out costs and ops: HSM ~$30k+ and DR doubles cost, PCI mandates FIPS 140-2 Level 3 for payment flows, archival of decryption keys for data recovery, and an operational timeline — start planning for post-quantum hybrid/composite approaches around 2026.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:57Cryptographic Key Basics
- 4:19Key Protection Goals
- 6:07Types and Usage of Keys
- 9:20Key Storage Solutions
- 11:12Security Controls and Enclaves
- 15:11Best Practices for Keys
- 17:44Layering Cryptographic Controls
- 24:53Enterprise Key Management
- 28:19Key Decision Factors
- 32:02Post-Quantum Preparedness
- 35:29Cloud Management Strategies
- 38:12Risk vs. Cost Analysis
- 40:47Conclusion and Q&A
related talks
51mUsing Key Management Service for data protection
45mLet's Encrypt Everything, Really Everything
15mEncryption at Rest – Master Key Based on a Hybrid KEM
32mEncryption - A Deeper Review
37mSecuring Data in the Quantum Era: From the Root of Trust to Protecting Ecosystems
38mHow to Distribute Keys Securely for 20% of the Web
20mUnderstanding the shared responsibility model and AWS KMS XKS
32mCare and Feeding of HSMs: Key Management in Hard Mode