Cryptographic key

As explained in Software Security for Developers

A secret key is confidential cryptographic material shared by authorized parties to compute or verify keyed security values.

A secret key is confidential cryptographic material shared by authorized parties. Unlike a plain hash, a keyed value lets recipients check that data came from someone who knows the key and was not modified. section 4.5

The key creates a trust boundary: senders and receivers can compute a MAC, HMAC, or encryption result, while an attacker who sees the message cannot produce a valid keyed result without the key. section 4.5 section 4.7

Handle secret keys as security-critical material:

• Store application and HMAC keys in a secure credential store rather than hardcoding them or placing them in plain-text configuration files. section 2.2.1 section 4.7
• Generate cryptographic randomness with SecureRandom, not java.util.Random, when creating keys or related random values. section 5.3
• Use the key with a designed construction such as HMAC; do not replace HMAC with simple key-and-message concatenation. section 4.5 section 4.7
• Treat possession as the ability to impersonate an authorized party or decrypt protected data, depending on the construction. section 4.6 section 11.5.2

Protecting an ACME refunds file

The Warehouse application computes HMAC-SHA256 over refunds.json and sends the file with its expected value. The payments service recomputes the HMAC using the shared key, compares the values, and processes refunds only when they match. If an attacker changes the file without knowing the key, validation fails and no refunds are processed. section 4.6 section 4.7

Figure 4.8 The MAC is data added to the end of a message that the receiver can use to verify who sent the message and whether it was tampered with.

Trace how a sender computes a MAC from a message and secret key, then how a receiver recomputes it to detect tampering and authenticate the sender. section 4.5

Secret keys support several goals. HMAC and JWS-HS256 provide integrity and authentication; AES-GCM and JWE additionally provide confidentiality. Public-key systems can establish shared symmetric keys for later protected communication. section 4.6 section 11.5.2 section 7.5

How Software Security for Developers covers it

How deep it goes

Explains keyed verification, storage risks, and Java implementations, while deferring the full key-agreement problem to public-key mechanisms.

Examples

Demonstrates refunds.json HMAC validation, AES-GCM encryption, Nimbus JWS signing, and JWE encryption and decryption.

What it assumes

Assumes basic messages and applications, then builds distinctions between hashes, keyed authentication, encryption, and public-key key agreement.

What you can do after

Apply it via HMAC, AES-GCM, JWS, or JWE while validating inputs and protecting keys from configuration and code exposure.

How it connects

Connects secret keys to MAC, HMAC, AES-GCM, JWS, JWE, TLS, RSA, and ECC.

liveBookmanning.com

Read Software Security for Developers on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Kubernetes in Action, Second EditionA Secret is a Kubernetes API resource for storing sensitive data such as credentials, tokens, or keys.
• 

  liveBookmanning.com
  Hacking CryptographyA value that controls cryptographic operations and is shared with or retained by authorized participants according to the security scheme.
• 

  liveBookmanning.com
  Real-World CryptographyA cryptographic key is secret or public information supplied to a cryptographic algorithm to control its operation.
• 

  liveBookmanning.com
  Infrastructure as Code, Patterns and Practices: With examples in Python and TerraformA secret is sensitive information, such as a password, token, or cryptographic key, whose disclosure could enable unauthorized access.

Compare how 5 books explain cryptographic key →

Related concepts

• AESused by · AES is a standardized symmetric block cipher that encrypts and decrypts data in 128-bit blocks using 128-, 192-, or 256-bit keys.
• symmetric key encryptionused by · Symmetric-key encryption is cryptography that uses the same shared secret key, or equivalent derived key material, to encrypt and decrypt data.
• elliptic-curve diffie-hellmanproduced by · Elliptic-curve Diffie-Hellman is a public-key key-agreement method in which parties derive a shared secret through elliptic-curve point operations.
• encryptionused by · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.
• HMACused by · HMAC is a keyed message authentication code constructed from a cryptographic hash function and a secret key to authenticate data and verify its integrity.
• Diffie–Hellman key exchangeproduced by · Diffie–Hellman key exchange is a public-key key-agreement protocol that enables parties to derive a shared secret over an insecure channel without transmitting it.

This explainer was generated by Manning's knowledge graph from the text of Software Security for Developers. The section links point to the parts of the book it draws on.