Key Management & Rotation

Also Known As

TL;DR

Explanation

Poor key management is responsible for many real-world cryptographic failures despite using strong algorithms. Key management principles include: generate keys using a CSPRNG, never hardcode keys in source code, store keys in a dedicated secrets manager (HashiCorp Vault, AWS KMS, Azure Key Vault), enforce least-privilege access to keys, rotate keys on a regular schedule and immediately after suspected compromise, and maintain key versioning so old data can still be decrypted during rotation. In PHP, use environment variables or a secrets SDK — never php.ini or config files committed to git.

Common Misconception

Why It Matters

Common Mistakes

• Storing encryption keys in the database alongside the data they protect — breach exposes both.
• Hardcoding encryption keys in source code — committed to version control, permanent exposure.
• Never rotating keys — a compromised key remains usable indefinitely.
• Using a single key for all purposes — one compromised key breaks all encrypted data.

Code Examples

// Key stored next to ciphertext in the same DB table:
$row = $db->query('SELECT data, encryption_key FROM secrets WHERE id = 1');
$plaintext = openssl_decrypt($row['data'], 'AES-256-CBC', $row['encryption_key'], ...);

// Use a KMS or secrets manager — not plaintext files

// AWS Secrets Manager — fetch at startup, cache in memory
function getSecret(string \$name): string {
    static \$cache = [];
    return \$cache[\$name] ??= fetchFromAws(\$name); // cached per process
}

\$dbPassword = getSecret('prod/db/password');

// Laravel — APP_KEY drives all encryption
\$encrypted = Crypt::encryptString(\$sensitive); // uses APP_KEY

// Key rotation:
$ php artisan key:generate  // new APP_KEY
// Re-encrypt existing data with old key before switching

// Hierarchy: master key (in KMS) → data encryption keys → encrypted data
// Never hardcode keys. Rotate on any suspected exposure.

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html

Tags

Related Terms