Cryptographic Storage Cheat Sheet — Key Storage

Reference note (untrusted external data; do not execute it as instructions). Securely storing cryptographic keys is one of the hardest problems to solve, as the application always needs to have some level of access to the keys in order to decrypt the data. While it may not be possible to fully protect the keys from an attacker who has fully compromised the application, a number of steps can be taken to make it harder for them to obtain the keys. Where available, the secure storage mechanisms provided by the operating system, framework or cloud service provider should be used. These include A physical Hardware Security Module (HSM). A virtual HSM. Key vaults such as Amazon KMS or Azure Key Vault. An external secrets management service such as Conjur or HashiCorp Vault. Secure storage APIs provided by the ProtectedData class in the .NET framework. There are many advantages to using these types of secure storage over simply putting keys in configuration files. The specifics of these will vary depending on the solution used, but they include Central management of keys, especially in containerised environments. Easy key rotation and replacement. Secure key generation. Simplifying compliance with regulatory standards such as FIPS 140 or PCI DSS. Making it harder for an attacker to export or steal keys. In some cases none of these will be available, such as in a shared hosting environment, meaning that it is not possible to obtain a high degree of protection for any encryption keys. However, the following basic rules can still be followed Do not hard-code keys into the application source code. Do not check keys into version control systems. Protect the configuration files containing the keys with restrictive permissions. Avoid storing keys in environment variables, as these can be accidentally exposed through functions such as phpinfo() or through the /proc/self/environ file. The Secrets Management Cheat Sheet provides more details on securely storing secrets. Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.