Cryptographic keys exist in different locations during their lifecycle. A key may be created in software, stored in a configuration file, loaded into process memory, protected by a platform module, retained in a hardware security module.

Cryptographic keys should be kept in a security boundary appropriate to their purpose, value, and workload. A device identity key, a certificate-authority key, a disk-encryption key, and a high-volume TLS traffic key do not have identical requirements.

TLS 1.3 protects data in transit, but active session secrets must exist somewhere while a connection runs. Learn what can be exposed when a server is compromised—and how hardware key custody changes the model.

Encryption protects data only while an attacker cannot obtain the cryptographic key needed to use it. A server may correctly encrypt storage, database records, backups, and network traffic, yet still handle active cryptographic keys in host memory while those services run.