In this lesson,
we will learn about Key Management.
Key management is made up of the processes
and protocols that generate, distribute, store,
and securely handle cryptographic keys
throughout their lifecycle.
Key management concepts include key stretching
and key splitting.
Key stretching is a technique used
to enhance the security of weak or short cryptographic keys
by applying iterative hashing
or encryption functions to the key.
Key splitting, on the other hand,
is the practice of dividing a cryptographic key
into multiple parts.
Let's learn more about key stretching and key splitting.
First, we have key stretching.
Key stretching works by repeatedly processing the user's key
through thousands of rounds of hashing or encryption,
transforming a simpler key
into a longer and more complex one that's harder to crack,
often extending the effective length of the key
to at least 128 bits.
This enhances the security of weak
or short cryptographic keys by applying iterative hashing
or encryption functions to them.
This method strengthens keys,
such as user-generated passwords or passphrases
by making brute force attacks
significantly more time consuming and resource intensive.
While key stretching does not
inherently make the key itself stronger,
it greatly increases the computational power
and time required for an attacker to brute force the key.
This is because each brute force attempt
must also go through the same key stretching process
involving thousands of iterations.
This slows down the attacker's progress,
providing better security even for weak passwords.
Two commonly used key stretching methods
are Password-Based Key Derivation Function 2,
or PBKDF2, and Bcrypt.
PBKDF2 enhances security
by combining the user's inputted password with a salt,
which is random data added to make each password unique.
PBKDF2 then uses a function
called hash-based message authentication code, or HMAC,
to mix the password and salt together.
This mixing process is repeated thousands of times,
making the resulting cryptographic key
much harder to crack.
Initially, PBKDF2 used about 1,000 iterations to be secure,
but as computing power has increased,
modern standards now often recommend
at least 310,000 iterations
when using HMAC with Secure Hash Algorithm
or SHA-256 to strong protection.
Salting is an integral part of key stretching.
It adds random data to each password before hashing.
This helps defend against password cracking methods
such as dictionary attacks and rainbow tables.
Each password gets a unique salt,
ensuring that even identical passwords
result in different hashes.
This approach makes it much more difficult for attackers
to use pre-computed rainbow tables to crack passwords,
and it adds an additional layer of security
without requiring users to change their password habits.
So by using salts, key stretching ensures
that even if one system is compromised,
the unique salt prevents the reuse of the cracked password
on other platforms,
safeguarding user data across different environments.
Next, Bcrypt is a popular key stretching method
that uses repeated hashing and salting to enhance security.
Bcrypt is designed as an adaptive function,
allowing it to increase the iteration count over time,
making it slower and more resistant to brute force attacks
as hardware capabilities improve.
This adaptability helps Bcrypt maintain robust security
and is why it is widely used in many operating systems,
including OpenBSD and various Linux distributions,
to protect stored passwords against brute force
and rainbow table attacks.
A rainbow table attack is a hacking technique
that uses pre-computed tables of hashed values
paired with their plaintext inputs
to quickly crack hashed passwords
by finding hash value matches.
This allows an attacker to compare an extracted hash
with a list of pre-computed hashes
and their associated plaintext passwords,
significantly speeding up the process
of finding the original password
without having to guess each one individually.
Second, we have key splitting.
Key splitting enhances the protection of cryptographic keys
by dividing them into multiple parts.
That is to say taking a single cryptographic key
and splitting it into separate pieces
with each one being stored independently and separately.
The idea is to ensure that no single part of the key
can be used to access encrypt data.
Only by combining all the separately stored parts
can the original key be reconstructed and used.
Key splitting increases security
by reducing the risk associated with key compromise.
Because even if an attacker gains access
to one part of the split key,
they cannot decrypt the information
without obtaining all other key parts.
This division of the key makes it significantly harder
for attackers to exploit a single point of failure.
For this reason,
key splitting is often used in highly secure environments
where multiple parties must work together
to access sensitive information,
ensuring that no single individual has complete control
over the entire cryptographic key.
For example, consider a secure online banking system
where access to sensitive financial data
requires three different components to work together.
One part of the key is stored on the bank's secure servers.
Another part is kept in a hardware security module
that the IT department can access,
and the final part is generated as a one-time access code
that is sent directly to a user's device
via a secure channel, such as an authenticator app.
To gain access, all three parts of the key must be combined,
the server stored key, the hardware module key,
and a user's one-time code.
This setup reflects key splitting in cryptography,
where dividing keys into separate parts
ensures that access is only granted
when all necessary elements come together.
Key splitting is particularly useful in scenarios
requiring high levels of trust and security,
such as financial transactions, government data protection,
or sensitive corporate information.
It helps mitigate risks
by ensuring that no single entity
has full access to the entire key,
making unauthorized access much more challenging.
So remember, key management involves generating,
distributing, storing, and handling cryptographic keys
securely throughout their lifecycle.
To important key management techniques are key stretching
and key splitting,
each designed to enhance security in different ways.
Key stretching strengthens weak
or short cryptographic keys
by applying iterative hashing or encryption,
making brute force attacks much more difficult
and time consuming.
Key splitting, on the other hand, increases security
by dividing a cryptographic key into multiple parts,
ensuring that no single part can be used to access data
and requiring all parts to be combined
to reconstruct the original key.