Skip to content

Key management

Level: 201 · for anyone who ships systems

Stub — an outline, not a lesson. There is no runnable example behind this page yet, so nothing on it has been through the check that backs every other claim in this library. The bullets below are the questions the finished page has to answer.

One line: The part that is actually hard, and the part no algorithm choice helps with.

The questions this page has to answer

  • Where does the key live — env var, file, KMS, HSM — and who can read each one?
  • What does 'encrypted at rest' protect against, precisely? (A stolen disk. Usually nothing else.)
  • How do you rotate a key without a downtime window, and what has to be versioned to make that possible?
  • What happens on restore from a backup taken before a rotation?
  • Who holds the key when the person who set it up leaves?

See also