-: In the lessons in this section,
I've spoken a lot about encryption keys.
I've also mentioned earlier
that the strength of any encryption
is based on the security of that key.
Because of this,
it's important to understand proper key management.
But what exactly is key management?
Well, key management refers to how an organization
is going to generate,
exchange,
store,
and use encryption keys.
Let's pretend for a moment
that you're a manager of an office building.
In this office building there are
50 different offices for rent.
As the building manager,
it's your responsibility to ensure
that each company that rents an office from you
gets the proper key. If you were to make a mistake
and gave my key to a different tenant,
they could go into my office and breach my confidentiality.
This is the same thing that we're worried about
with our encryption systems.
When you're generating a key,
you need to ensure that it's a strong key.
Many implementations are going to rely on the user
creating that initial key by entering in a password.
For example,
if you decide to use BitLocker or FileVault
to encrypt the contents of your hard drive,
it's going to ask you to create a master password
that's going to be used as the key for the encryption.
So if you choose a weak password as a key,
it doesn't matter that the algorithm being used
is using the advanced encryption system,
and it's currently unbreakable.
If someone can break your key by guessing your password,
they can compromise the confidentiality of your files.
We've already talked about
the importance of secure key exchange
when we were talking about symmetric encryption.
Most of the time we do this by using asymmetric methods
to encrypt the symmetric key,
and then transmit it securely over a network.
This is the basic concept of the Diffie-Hellman algorithm,
for example.
And it's used in many other places, too,
such as VPN connections,
SSL or TLS connections,
and others.
Now it's important that they key
is also securely stored when you're not using it.
Just like a password,
if that key is left out and somebody else can find it,
you now can have them decrypt your files
and breach your confidentiality.
Finally, it's important to remember that,
like your passwords,
your keys need to be changed periodically.
If you've been using the same encryption key for 10 years,
that means an attacker has had 10 years worth of time
to try to break into your information.
By changing your key,
you reset the clock on the attack
and make the attacker have to start all over again,
giving you additional security
and confidentiality to your files.
(electronic tones reverberating)