Module 77: Encryption and Secrets
Keys
🏠The everyday picture
The strongest safe in the world is useless if its key hangs on a nail beside it. Protecting the key is the real job.
📘What it really is
- Encryption is only as strong as the protection of its keys. Key management covers:
- generation: from a secure random source (
crypto.randomBytes(32)), never typed by a person; - storage: not beside the data it protects; ideally in a key management service (KMS) (AWS KMS, Google Cloud KMS, Azure Key Vault) or a hardware security module, where the key never leaves;
- access: only the program that needs it, logged;
-
rotation and retirement (Lesson 5).
-
Envelope encryption: data is encrypted with a data key; the data key is itself encrypted with a master key in the KMS. Rotating the master key doesn't require re-encrypting all the data. Cloud services use this pattern internally.
-
Your own key pairs:
- SSH keys (Module 64): protect private keys with a passphrase; one key per device; remove old ones from servers;
- deploy keys (Module 71): one per server or pipeline, read-only where possible;
-
signing keys (for JWTs, Git commits): kept private; publish only the public part.
-
Losing a key can mean losing the data forever (encrypted backups with a lost key are gone). Keep secure, offline, documented recovery copies of critical keys.
🖱️Try it
List every key your CRM depends on: TLS certificate private key, SSH keys, deploy keys, session or JWT signing secret, backup encryption key, any field-encryption key. For each, write where it's stored, who and what can read it, and where the recovery copy is. Move any key stored beside the data it protects.
✅Quick check
Why shouldn't an encryption key be stored next to the encrypted data?
Show the answer
Anyone who gets the data would get the key too, making the encryption pointless.
What's envelope encryption?
Show the answer
Encrypting data with a data key, then encrypting that key with a master key held in a key management service.