I85PREP
⌘ K
EUC-EO study materials
EUC-EO study resources

EUC-EO: Key Management, Distribution, and Storage

EUC-EO · Work through your exam, one topic at a time.

All guide sections

Key Management, Distribution, and Storage

Keys are the whole secret, so their lifecycle (generation, distribution, storage, rotation, destruction) decides whether the cryptography holds. This domain tests key hierarchies, secure distribution, split control and where keys should live.

Core rules

  • Generation needs a cryptographically secure random number generator seeded with real entropy; weak PRNGs, such as the time-seeded Debian OpenSSL bug, have destroyed real keys.
  • Distribution: symmetric keys are wrapped (encrypted) under a key-encryption key, delivered by a KDC as in Kerberos, or derived via DH/ECDH. Public keys travel openly but must be authenticated.
  • Hierarchy: a data encryption key (DEK) encrypts data; a key encryption key (KEK) wraps the DEK. Rotating the KEK means re-wrapping DEKs, not re-encrypting terabytes of data.
  • Storage: HSMs and TPMs keep keys non-exportable and perform operations internally; keys must never sit in source code, config files or memory dumps longer than necessary.
  • Controls: split knowledge and dual control (two people, two halves), M-of-N secret sharing, key escrow and recovery, and zeroisation of memory on decommission.
  • Perfect forward secrecy comes from ephemeral per-session keys, so compromise of a long-term key does not expose past sessions.

Worked example

Twenty staff need confidential communication. Symmetric keys alone require 20 x 19 / 2 = 190 pairwise keys, each needing secure distribution, which is a scaling and logistics problem. Issuing each person one key pair cuts storage to 20 private keys, and each session can use an ephemeral ECDH exchange whose derived key is destroyed afterwards. Two problems remain: proving who owns each public key (PKI) and protecting the private keys (HSM or OS keystore).

Traps

AES-256 is worthless if the key is 'Company123'. Deleting a file does not erase the key from backups, swap or HSM slots. Escrow protects availability but creates a high-value target. Halving a key between two people is not split knowledge; proper sharing yields shares that individually reveal nothing.