new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

key_management/storage

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Memory media recovery planning

Plan for loss or corruption of memory media on which keys and/or certificates are stored. Plan for recovery from possible corruption of memory media necessary for key or certificate generation, registration, and/or distribution systems, subsystems, or components as recommended in NIST SP 800-57.

Key storage location and device understanding

Developers must understand where cryptographic keys are stored within the application and understand what memory devices the keys are stored on.

Key protection on volatile and persistent memory

Keys must be protected on both volatile and persistent memory, ideally processed within secure cryptographic modules.

Plaintext key storage prohibition

Keys should never be stored in plaintext format.

Cryptographic vault storage requirement

Ensure all keys are stored in a cryptographic vault, such as a hardware security module (HSM) or isolated cryptographic service.

Offline key storage and Key Encryption Key usage

If planning to store keys in offline devices/databases, encrypt the keys using Key Encryption Keys (KEKs) prior to export of the key material. KEK length (and algorithm) should be equivalent to or greater in strength than the keys being protected.

Key integrity protection in storage

Ensure that keys have integrity protections applied while in storage. Consider dual purpose algorithms that support encryption and Message Code Authentication (MAC).

Standard application code key access prohibition

Ensure that standard application level code never reads or uses cryptographic keys in any way and use key management libraries.

Vault-contained key operations requirement

Ensure that keys and cryptographic operation is done inside the sealed vault. All work should be done in the vault (such as key access, encryption, decryption, signing, etc).

Give your agent this brain