Key Management Lifecycle Lab
Generating a strong key is the easy part. Knowing what order to move it through its lifecycle, how often to rotate it, and exactly what to do the moment it is suspected compromised — without stranding your own encrypted data or breaking non-repudiation — is what separates real key management from a key sitting in a config file. Run keys through generate → distribute → rotate → retire → archive → destroy, choose crypto-periods, respond to a compromise, and make storage calls, all graded against NIST SP 800-57-style rules.
The real job. More noise, a tighter clock.
Run the keys through their lifecycle
You are the key custodian. Across 5 challenges you will order a key’s lifecycle, choose the right crypto-period, run the emergency response to a compromise, and make storage decisions — all against NIST SP 800-57-style rules. Clear 80% with no critical mistake to pass; finish under par for a speed bonus.
What this lab is
- A free, browser-based cryptography lab: run cryptographic keys through their full lifecycle — generate, distribute/activate, rotate, deactivate, archive, destroy — the way NIST SP 800-57 prescribes.
- Four graded challenge types: order the lifecycle for a given key, choose the right crypto-period, run the emergency response to a suspected key compromise, and make sound key-storage decisions.
- Order and proportionality are the whole skill: destroy a compromised data key before you re-encrypt and the ciphertext is stranded; escrow a signing key and you break non-repudiation; over-rotate on a public-key non-event and you cause an outage for nothing.
- Harder tiers add the nasty variants — a compromised signing key (destroy, don’t preserve), a shared KEK whose backup was also exposed, partial exposure, and stricter cadence rules.
- Every challenge grades against the real rules and explains the reasoning, with a live arena showing a key-thief adversary working against stale, hardcoded and un-rotated keys.
Frequently asked questions
What is the Key Management Lifecycle Lab?
A free, in-browser exercise where you manage cryptographic keys across their lifecycle. You order the lifecycle states for a given key type, pick an appropriate crypto-period (rotation cadence) for its use, respond to a suspected key compromise in the correct emergency sequence, and make key-storage decisions (HSM/KMS, dual control, escrow trade-offs). Each challenge is graded against NIST SP 800-57-style rules and explained.
Why does the order matter so much?
Because the costliest key-management mistakes are ordering and decision mistakes. Destroy a compromised data-encryption key before you re-encrypt the data and you lose access to your own ciphertext forever. Restore a KEK from a backup that was stored in the same vault that leaked and you re-introduce the compromise. Rotate a signing key but keep the old private key "just in case" and you leave a forgery-capable key alive. The lab models these as hard rules, not opinions.
Why is escrow right for one key and wrong for another?
Escrow is a deliberate trade-off. You escrow (back up) a data-encryption key so that long-lived ciphertext stays recoverable if the primary copy is lost. You never escrow a private signing key, because a second copy breaks non-repudiation and enables forgery — there is no recoverability argument for a key that encrypts nothing. Learning when each rule applies is a core part of the lab.
Does this do real cryptography?
The grading is based on bundled scenarios — no network, no server, no account. There is an optional flavour button that generates a throwaway AES-256 key locally with the browser’s crypto.subtle API; that key never leaves your browser and is not used for grading. The lab teaches lifecycle decisions, not primitive implementation.