Keys and operations
Generate keys securely
Use cryptographically secure platform or key-management APIs with the exact size and algorithm required instead of deriving keys from memorable text.
8 minute lesson
Cryptographic keys need enough unpredictable bits. Human-created phrases and ordinary random functions do not provide them.
Let a maintained library, operating system, HSM, or KMS generate keys. Use a password KDF only when a user password must derive key material, with a salt and current parameters. Never print generated keys while debugging.
import { randomBytes } from 'node:crypto'
const key = randomBytes(32)A developer derives an encryption key with SHA-256 from a memorable deployment phrase. An attacker who obtains ciphertext can test likely phrases offline much faster than searching a random key space.
Generate application keys with a cryptographic system source or managed key service. Use a password KDF only when a human password is an unavoidable input.
Trace the generation API and random source for every key in one small application, and save algorithm plus length metadata without saving key bytes. Generate two keys and prove they differ and satisfy the library format. Then block or mock the random source and confirm generation fails instead of falling back to a timestamp or ordinary random function.
Lesson completed