In the lessons,
I've spoken a lot about encryption keys.
I've also mentioned earlier
that the strength of any encryption
is based on the security of that key.
Because of this,
it's important to understand proper key management,
but what exactly is key management?
Well, key management refers to how an organization
is going to generate, exchange, store,
and use encryption keys.
Let's pretend for a moment
that you're a manager of an office building.
In this office building,
there are 50 different offices for rent.
As the building manager,
it's your responsibility to ensure that each company
that rents an office from you
gets the proper key.
If you were to make a mistake
and gave my key to a different tenant,
they could go into my office
and breach my confidentiality.
This is the same thing that we're worried about
with our encryption systems.
When you're generating a key,
you need to ensure that it's a strong key.
Many implementations are going to rely on
the user creating that initial key
by entering in a password.
For example, if you decide to use BitLocker or FileVault
to encrypt the contents of your hard drive,
it's going to ask you to create a master password
that's going to be used as the key for the encryption.
So if you choose a weak password as the key,
it doesn't matter that the algorithm being used
is using the advanced encryption system
and it's currently unbreakable.
If someone can break your key by guessing your password,
they can compromise the confidentiality of your files.
We've already talked about the importance
of secure key exchange
when we were talking about symmetric encryption,
most of the time we do this
by using asymmetric methods to encrypt the symmetric key
and then transmit it securely over a network.
This is the basic concept
of the Diffie-Hellman Algorithm, for example,
and it's used in many other places too,
such as VPN Connections,
SSL, or TLS connections, and others.
Now, it's important that the key is also securely stored
when you're not using it.
Just like a password,
if that key is left out
and somebody else can find it,
you now can have them decrypt your files
and breach your confidentiality.
Finally, it's important to remember
that like your passwords,
your keys need to be changed periodically.
If you've been using the same encryption key for 10 years,
that means an attacker's had 10 years' worth of time
to try to break into your information.
By changing your key,
you reset the clock on the attack
and make the attacker to start all over again,
giving you additional security
and confidentiality to your files.