I'm working on securing encryption keys in a software application. The common practice of storing encrypted keys in configuration files leads to the challenge of securely storing and accessing the decryption keys.

Two approaches I'm considering are:

  1. Storing decryption keys in cloud services (AWS, Azure, Oracle OCI): This seems to require additional credentials (key pairs or IAM) to access the keys, raising the question of where to store those credentials securely.
  2. Embedding decryption keys directly in the source code: This is often discouraged due to immutability concerns and increased risk of exposure.

I'm looking for guidance on best practices for managing decryption keys in this scenario. How do experienced developers typically address this challenge and avoid the recursive problem of securing the final key? Are there alternative approaches to consider that balance security and practicality?

Thank you!

1 Answer 1


Keys should be stored either in a software keyring or a hardware security module (HSM).

For a software solution, you can use the keyring service of your operation system. Linux has the Kernel Key Retention Service which allows you to store keys in kernel space with fine-grained access controls. In Windows, there's the Credential Locker.

Another option would be to store the keys in an HSM. This means you have a completely separate hardware device which performs cryptographic operations without ever exposing the key itself. Dedicated HSMs can be quite expensive, but if you don't need a lot of computational power, you can use cheap Trusted Platform Modules (TPM) for your mainboard or the firmware TPM of your CPU. Intel has the Platform Trust Technology, AMD has fTPM.

If none of this is an option, then either store the key in the process memory of the application or in a file which can only be read by the application. Definitely don't put credentials into source code.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .