An encryption key is a secret value – a string of bits – that a cryptographic algorithm uses to encrypt and decrypt data; whoever holds the key can read the protected information.
How encryption keys work
Modern encryption follows Kerckhoffs’s principle: the algorithm is public, and security depends entirely on keeping the key secret. There are two main kinds of keys:
- Symmetric keys – one shared secret for encryption and decryption, for example a 128- or 256-bit AES key.
- Key pairs in public-key cryptography – a public key that can be shared freely and a private key that must stay secret; RSA keys are typically 2048 bits or longer, elliptic-curve keys 256 bits.
Key length determines resistance to brute force: trying all 2^128 possible AES keys is far beyond any computer. Keys are generated from a cryptographically secure random number generator or derived from a password using functions such as PBKDF2 or Argon2.
Why key management matters
Strong algorithms are useless if keys leak. Common problems include keys hard-coded in source code or firmware (CWE-321), stored next to the encrypted data, committed to public repositories or kept in memory where malware can read them. In 2023 the Storm-0558 group used a stolen Microsoft consumer signing key to forge tokens and access the email of US government agencies – a reminder that a single key can open thousands of accounts. Ransomware, conversely, relies on the victim not having the attacker’s key.
Best practices
- Follow a key lifecycle – generation, storage, rotation, revocation and destruction – as described in NIST SP 800-57.
- Store keys in hardware: HSMs, cloud key management services or a TPM.
- Separate keys from the data they protect and limit who can use them.
- Rotate keys regularly and immediately after a suspected compromise.
