Editing Key (cryptography)

{{Short description|Used for encoding or decoding ciphertext}}
A '''key''' in [[cryptography]] is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic [[algorithm]], can [[Encryption|encode]] or decode cryptographic data. Based on the used method, the key can be different sizes and varieties, but in all cases, the strength of the encryption relies on the security of the key being maintained. A key's [[security strength]] is dependent on its algorithm, the size of the key, the generation of the key, and the process of key exchange.

== Scope ==
The key is what is used to encrypt data from [[plaintext]] to [[ciphertext]].<ref>{{Citation|last=Piper|first=Fred|title=Cryptography|date=2002|url=https://onlinelibrary.wiley.com/doi/abs/10.1002/0471028959.sof070|encyclopedia=Encyclopedia of Software Engineering|publisher=American Cancer Society|language=en|doi=10.1002/0471028959.sof070|isbn=978-0-471-02895-6|access-date=2021-04-09|url-access=subscription}}</ref> There are different methods for utilizing keys and encryption.

=== Symmetric cryptography ===
[[Symmetric cryptography]] refers to the practice of the same key being used for both encryption and decryption.<ref>{{Cite web|title=What is a cryptographic key? {{!}} Keys and SSL encryption|url=https://www.cloudflare.com/learning/ssl/what-is-a-cryptographic-key}}</ref>

=== Asymmetric cryptography ===
[[Asymmetric cryptography]] has separate keys for encrypting and decrypting.<ref>{{Cite web|title=Asymmetric-Key Cryptography|url=https://www.cs.cornell.edu/courses/cs5430/2013sp/TL04.asymmetric.html|access-date=2021-04-02|website=www.cs.cornell.edu}}</ref><ref>{{Cite book|last1=Chandra|first1=S.|last2=Paira|first2=S.|last3=Alam|first3=S. S.|last4=Sanyal|first4=G.|title=2014 International Conference on Electronics, Communication and Computational Engineering (ICECCE) |chapter=A comparative survey of Symmetric and Asymmetric Key Cryptography |date=2014|chapter-url=https://ieeexplore.ieee.org/document/7086640|pages=83–93|doi=10.1109/ICECCE.2014.7086640|isbn=978-1-4799-5748-4 |s2cid=377667 }}</ref> These keys are known as the public and private keys, respectively.<ref>{{Cite book|last1=Kumar|first1=M. G. V.|last2=Ragupathy|first2=U. S.|title=2016 International Conference on Wireless Communications, Signal Processing and Networking (WiSPNET) |chapter=A Survey on current key issues and status in cryptography |date=March 2016|chapter-url=https://ieeexplore.ieee.org/document/7566121|pages=205–210|doi=10.1109/WiSPNET.2016.7566121|isbn=978-1-4673-9338-6 |s2cid=14794991 }}</ref>

== Purpose ==
Since the key protects the confidentiality and integrity of the system, it is important to be kept secret from unauthorized parties. With public key cryptography, only the private key must be kept secret, but with symmetric cryptography, it is important to maintain the confidentiality of the key. [[Kerckhoffs's principle|Kerckhoff's principle]] states that the entire security of the cryptographic system relies on the secrecy of the key.<ref>{{Cite book|last1=Mrdovic|first1=S.|last2=Perunicic|first2=B.|title=Networks 2008 - the 13th International Telecommunications Network Strategy and Planning Symposium |chapter=Kerckhoffs' principle for intrusion detection |date=September 2008|chapter-url=https://ieeexplore.ieee.org/document/6231360|volume=Supplement|pages=1–8|doi=10.1109/NETWKS.2008.6231360|isbn=978-963-8111-68-5 }}</ref>

== Key sizes ==
{{main|Key size}}

[[Key size]] is the number of [[bit]]s in the key defined by the algorithm. This size defines the upper bound of the cryptographic algorithm's security.<ref>{{Cite web|title=What is Key Length? - Definition from Techopedia|url=http://www.techopedia.com/definition/3999/key-length|access-date=2021-05-01|website=Techopedia.com|date=16 November 2011 |language=en}}</ref> The larger the key size, the longer it will take before the key is compromised by a brute force attack. Since perfect secrecy is not feasible for key algorithms, researches are now more focused on computational security.

In the past, keys were required to be a minimum of 40 bits in length, however, as technology advanced, these keys were being broken quicker and quicker. As a response, restrictions on symmetric keys were enhanced to be greater in size.

Currently, 2048 bit [[RSA (cryptosystem)|RSA]]<ref>{{Cite journal|last=Hellman|first=Martin|title=An Overview of Public Key Cryptography|url=https://netlab.ulusofona.pt/im/teoricas/OverviewPublicKeyCryptography.pdf|journal=IEEE Communications Magazine}}</ref> is commonly used, which is sufficient for current systems. However, current RSA key sizes would all be cracked quickly with a powerful quantum computer.<ref>{{Cite web |date=2024-08-23 |title=Toward a code-breaking quantum computer |url=https://news.mit.edu/2024/toward-code-breaking-quantum-computer-0823 |access-date=2025-05-14 |website=MIT News {{!}} Massachusetts Institute of Technology |language=en}}</ref>

"The keys used in public key cryptography have some mathematical structure. For example, public keys used in the RSA system are the product of two prime numbers. Thus public key systems require longer key lengths than symmetric systems for an equivalent level of security. 3072 bits is the suggested key length for systems based on factoring and integer discrete logarithms which aim to have security equivalent to a 128 bit symmetric cipher."<ref>{{Cite web|date=2013-05-27|title=Anatomy of a change – Google announces it will double its SSL key sizes|archive-url=https://web.archive.org/web/20230908035830/https://nakedsecurity.sophos.com/2013/05/27/anatomy-of-a-change-google-announces-it-will-double-its-ssl-key-sizes/ |archive-date=8 September 2023|url=https://nakedsecurity.sophos.com/2013/05/27/anatomy-of-a-change-google-announces-it-will-double-its-ssl-key-sizes/|access-date=2021-04-09|website=Naked Security|language=en-US}}</ref>

== Key generation ==
{{Main|Key generation}}
To prevent a key from being guessed, keys need to be generated randomly and contain sufficient [[Entropy (information theory)|entropy]]. The problem of how to safely generate random keys is difficult and has been addressed in many ways by various cryptographic systems. A key can directly be generated by using the output of a Random Bit Generator (RBG), a system that generates a sequence of unpredictable and unbiased bits.<ref>{{Cite web|last=Dang|first=Quynh|date=August 2012|title=Recommendation for Applications Using Approved Hash Algorithms|url=https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-107r1.pdf|access-date=2021-04-02}}</ref> A RBG can be used to directly produce either a symmetric key or the random output for an asymmetric key pair generation. Alternatively, a key can also be indirectly created during a key-agreement transaction, from another key or from a password.<ref name=NIST>{{cite journal |url=https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-132.pdf | doi=10.6028/NIST.SP.800-132 | title=Recommendation for password-based key derivation | date=2010 | last1=Turan | first1=M. S. | last2=Barker | first2=E. B. | last3=Burr | first3=W. E. | last4=Chen | first4=L. | s2cid=56801929 }}</ref>

Some operating systems include tools for "collecting" entropy from the timing of unpredictable operations such as disk drive head movements. For the production of small amounts of keying material, ordinary dice provide a good source of high-quality randomness.

== Establishment scheme ==
{{Main|Key exchange}}
The security of a key is dependent on how a key is exchanged between parties. Establishing a secured communication channel is necessary so that outsiders cannot obtain the key. A key establishment scheme (or key exchange) is used to transfer an encryption key among entities. Key agreement and key transport are the two types of a key exchange scheme that are used to be  remotely exchanged between entities . In a key agreement scheme, a secret key, which is used between the sender and the receiver to encrypt and decrypt information, is set up to be sent indirectly. All parties exchange information (the shared secret) that permits each party to derive the secret key material. In a key transport scheme, encrypted keying material that is chosen by the sender is transported to the receiver. Either symmetric key or asymmetric key techniques can be used in both schemes.<ref name=NIST/>

The [[Diffie–Hellman key exchange]] and [[Rivest-Shamir-Adleman]] (RSA) are the most two widely used key exchange algorithms.<ref name=":1">{{Cite book|last1=Yassein|first1=M. B.|last2=Aljawarneh|first2=S.|last3=Qawasmeh|first3=E.|last4=Mardini|first4=W.|last5=Khamayseh|first5=Y.|title=2017 International Conference on Engineering and Technology (ICET) |chapter=Comprehensive study of symmetric key and asymmetric key encryption algorithms |date=2017|chapter-url=https://ieeexplore.ieee.org/document/8308215/;jsessionid=aTy3qyMmnoiUUKufk8VEl4llW1jnhntWSm9CUa21rjkJ3qW3bths!861039390|pages=1–7|doi=10.1109/ICEngTechnol.2017.8308215|isbn=978-1-5386-1949-0 |s2cid=3781693 }}</ref> In 1976, [[Whitfield Diffie]] and [[Martin Hellman]] constructed the [[Diffie–Hellman key exchange|Diffie–Hellman]] algorithm, which was the first public key algorithm. The [[Diffie–Hellman key exchange|Diffie–Hellman]] key exchange protocol allows key exchange over an insecure channel by electronically generating a shared key between two parties. On the other hand, [[Rivest–Shamir–Adleman|RSA]] is a form of the asymmetric key system which consists of three steps: key generation, encryption, and decryption.<ref name=":1" />

Key confirmation delivers an assurance between the key confirmation recipient and provider that the shared keying materials are correct and established. The [[National Institute of Standards and Technology]] recommends key confirmation to be integrated into a key establishment scheme to validate its implementations.<ref name=NIST/>

== Management ==
{{Main|Key management}}
[[Key management]] concerns the generation, establishment, storage, usage and replacement of cryptographic keys. A [[Key management|key management system]] (KMS) typically includes three steps of establishing, storing and using keys. The base of security for the generation, storage, distribution, use and destruction of keys depends on successful key management protocols.<ref>{{Cite web|last=Barker|first=Elaine|date=January 2016|title=Recommendation for Key Management|url=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf|access-date=2021-04-02}}</ref>

== Key vs password ==

A password is a memorized series of characters including letters, digits, and other special symbols that are used to verify identity. It is often produced by a human user or a password management software to protect personal and sensitive information or generate cryptographic keys. Passwords are often created to be memorized by users and may contain non-random information such as dictionary words.<ref name=NIST/> On the other hand, a key can help strengthen password protection by implementing a cryptographic algorithm which is difficult to guess or replace the password altogether. A key is generated based on random or pseudo-random data and can often be unreadable to humans.<ref>{{Cite web|last=Khillar|first=Sagar|title=Difference Between Encryption and Password Protection {{!}} Difference Between|date=29 April 2020 |url=http://www.differencebetween.net/technology/difference-between-encryption-and-password-protection/|access-date=2021-04-02|language=en-US}}</ref>

A password is less safe than a cryptographic key due to its low entropy, randomness, and human-readable properties. However, the password may be the only secret data that is accessible to the cryptographic algorithm for [[information security]] in some applications such as securing information in storage devices. Thus, a deterministic algorithm called a [[key derivation function]] (KDF) uses a password to generate the secure cryptographic keying material to compensate for the password's weakness. Various methods such as adding a [[Salt (cryptography)|salt]] or key stretching may be used in the generation.<ref name=NIST/>

== See also ==
{{Div col|colwidth=25em}}
* [[Cryptographic key types]] 
* [[Diceware]] 
* [[EKMS]]
* [[Group key]]
* [[HMAC|Keyed hash algorithm]]
* [[Key authentication]]
* [[Key derivation function]]
* [[Key distribution center]]
* [[Key escrow]]
* [[Key exchange]]
* [[Key generation]]
* [[Key management]]
* [[Key schedule]]
* [[Key server (cryptographic)|Key server]]
* [[Key signature (cryptography)]]
* [[Key signing party]]
* [[Key stretching]]
* [[Key-agreement protocol]]
* [[List of cryptographic key types|glossary]] 
* [[Password psychology]]
* [[Public key fingerprint]]
* [[Random number generator]]
* [[Session key]]
* [[Tripcode]]
* [[Trusted paper key|Machine-readable paper key]]
* [[Weak key]]
{{div col end}}

== References ==

<references/>

{{cryptography navbox}}

<!-- Interlang -->
<!-- Categories -->
[[Category:Key management]]