Cryptographic key
A cryptographic key is a value supplied to a cryptographic algorithm to control operations such as encryption, decryption, signing, authentication, or verification.
Software Security for Developers
A secret key is confidential cryptographic material shared by authorized parties to compute or verify keyed security values.
- How it is used
- Uses shared secrets to authenticate messages, protect data, sign tokens, and support secure service-to-service or network communication.
- How deep it goes
- Explains keyed verification, storage risks, and Java implementations, while deferring the full key-agreement problem to public-key mechanisms.
- Examples
- Demonstrates refunds.json HMAC validation, AES-GCM encryption, Nimbus JWS signing, and JWE encryption and decryption.
- What you can do after
- Apply it via HMAC, AES-GCM, JWS, or JWE while validating inputs and protecting keys from configuration and code exposure.
Read how Software Security for Developers explains cryptographic key →
Kubernetes in Action, Second Edition
A Secret is a Kubernetes API resource for storing sensitive data such as credentials, tokens, or keys.
- How it is used
- Stores sensitive application values separately from ConfigMaps and supplies them to containers, image pulls, or TLS termination.
- How deep it goes
- Explains fields, creation, environment injection, and security limits; defers file projection to the treatment of volumes.
- Examples
- Uses kubectl-created credentials, a secretKeyRef environment variable, a private-registry pull Secret, and an Ingress TLS certificate.
- What you can do after
- Apply it via kubectl and pod manifests to supply sensitive values while recognizing encoding, access, and rotation risks.
Read how Kubernetes in Action, Second Edition explains cryptographic key →
Hacking Cryptography
A value that controls cryptographic operations and is shared with or retained by authorized participants according to the security scheme.
- How it is used
- Uses keys to enforce confidentiality by allowing intended participants to encrypt and decrypt while excluding eavesdroppers.
- How deep it goes
- Explains symmetric-key behavior, uniform generation, XOR reversibility, and RC4 key recovery, but does not detail modern key-management procedures.
- Examples
- Uses XOR truth tables, symmetric encryption diagrams, biased random keys, and RC4-based WEP traffic attacks.
- What you can do after
- Understand how shared keys control symmetric encryption, why randomness matters, and how weak stream-cipher use can expose keys.
Real-World Cryptography
A cryptographic key is secret or public information supplied to a cryptographic algorithm to control its operation.
- How it is used
- Uses secret information to control cryptographic algorithms while keeping the algorithms available for open scrutiny.
- How deep it goes
- Explains secrecy, threat consequences, and open evaluation, but stops short of key-generation or key-management procedures.
- Examples
- Uses intercepted website messages, leaked keys, unauthorized decryption, ciphertext leakage, and AES’s NIST competition as examples.
- What you can do after
- Evaluate cryptographic designs by identifying secret-key exposure, unauthorized decryption, ciphertext leakage, and reliance on obscurity.
Read how Real-World Cryptography explains cryptographic key →
Infrastructure as Code, Patterns and Practices: With examples in Python and Terraform
A secret is sensitive information, such as a password, token, or cryptographic key, whose disclosure could enable unauthorized access.
- How it is used
- Protects infrastructure automation, resource configuration, and delivery pipelines from credential disclosure and unnecessary attack surface.
- How deep it goes
- Explains definition, storage, variable passing, rotation, failure impact, and pipeline exposure, but does not detail a specific secrets-manager implementation.
- Examples
- Uses GCP service credentials, SSL certificates, SSH keys, API tokens, passwords, and a leaked root database password in pipeline logs.
- What you can do after
- Operate/configure infrastructure automation by externalizing secrets, rotating certificates, and reducing credential exposure in delivery pipelines.
Related concepts
- AESused by · AES is a standardized symmetric block cipher that encrypts and decrypts data in 128-bit blocks using 128-, 192-, or 256-bit keys.
- symmetric key encryptionused by · Symmetric-key encryption is cryptography that uses the same shared secret key, or equivalent derived key material, to encrypt and decrypt data.
- elliptic-curve diffie-hellmanproduced by · Elliptic-curve Diffie-Hellman is a public-key key-agreement method in which parties derive a shared secret through elliptic-curve point operations.
- encryptionused by · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
- HMACused by · HMAC is a keyed message authentication code constructed from a cryptographic hash function and a secret key to authenticate data and verify its integrity.
- Diffie–Hellman key exchangeproduced by · Diffie–Hellman key exchange is a public-key key-agreement protocol that enables parties to derive a shared secret over an insecure channel without transmitting it.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.