Glossary
K
31 terms.
- Keep-alive
A small message sent regularly over a connection to keep a NAT or firewall binding open and to learn whether the connection still works.
Plain language A small message sent regularly over a connection to prevent NAT or firewall from closing it.
Used in RFC 1001 RFC 3053 RFC 5351 RFC 5405 RFC 5626 RFC 6520 RFC 8895
- Keepalive
A small message sent periodically so that a NAT, firewall or peer does not decide a connection is idle and forget it.
Plain language A periodic message so a NAT, firewall, or peer does not forget an idle connection.
Used in RFC 1774 RFC 2525 RFC 3519 RFC 4233 RFC 5534 RFC 6887 RFC 8490
- Kerberos
A network authentication protocol in which a trusted Key Distribution Center issues tickets so clients and servers can prove their identities without sending passwords over the network. Version 5 is specified in RFC 4120.
Plain language A network authentication protocol where a trusted center issues tickets proving identity.
Used in RFC 1176 RFC 1282 RFC 1409 RFC 1411 RFC 1416 RFC 1487 RFC 1507 RFC 1511 RFC 1704 RFC 1731 RFC 1813 RFC 1823 RFC 1943 RFC 1961 RFC 1964 RFC 2025 RFC 2078 RFC 2094 RFC 2193 RFC 2196 RFC 2203 RFC 2222 RFC 2228 RFC 2316 and 103 more
- Key chain
A named list of keys, each with a Key ID, key string, algorithm and lifetimes. It acts as a reusable key policy that protocols can refer to by name.
Plain language A named list of keys with IDs, strings, algorithms, and lifetimes.
Used in RFC 5776 RFC 7210 RFC 7645 RFC 8177 RFC 9129 RFC 9314 RFC 9986
- Key derivation
A function that turns a master key into several independent session keys. SRTP uses AES in counter mode as the pseudo-random function.
Plain language A function turning a master key into several independent session keys.
Used in RFC 2082 RFC 2144 RFC 2268 RFC 2274 RFC 2523 RFC 2631 RFC 2828 RFC 2898 RFC 3185 RFC 3211 RFC 3370 RFC 3711 RFC 3748 RFC 3766 RFC 3826 RFC 3830 RFC 3957 RFC 3961 RFC 3962 RFC 4017 RFC 4107 RFC 4121 RFC 4187 RFC 4357 and 131 more
- Key derivation function
A one-way function that expands a shared secret into the separate symmetric keys a protocol needs, so that each direction and purpose can use its own key.
Plain language Turns one shared secret into the different keys that each part of the protocol needs.
Used in RFC 5647 RFC 5926 RFC 6030 RFC 7210 RFC 7664 RFC 7836 RFC 8645 RFC 9303
- Key Distribution Center
A trusted server that stores encryption keys and issues tickets to authenticated clients and servers, allowing them to prove their identity to each other without direct trust.
Plain language A trusted server that stores encryption keys and issues tickets proving identity.
- Key Distribution Center (KDC)
The trusted Kerberos server that holds every principal's secret key and issues tickets. It combines the Authentication Service (AS) and the Ticket-Granting Service (TGS).
Plain language The Key Distribution Center, a trusted Kerberos server that issues tickets.
Used in RFC 1510 RFC 1964 RFC 2094 RFC 2230 RFC 2712 RFC 3244 RFC 3634 RFC 3962 RFC 4101 RFC 4120 RFC 4121 RFC 4430 RFC 4537 RFC 4556 RFC 4557 RFC 4757 RFC 5021 RFC 5868 RFC 5896 RFC 6111 RFC 6113 RFC 6251 RFC 6448 RFC 6560 and 10 more
- Key encapsulation mechanism
A KEM lets one party use another's public key to create a fresh shared secret and a ciphertext that only the key holder can open. ML-KEM is one example.
Plain language A method where one party uses another's public key to create a shared secret in a sealed package.
Used in RFC 9180 RFC 9629 RFC 9690 RFC 9794 RFC 9810 RFC 9935 RFC 9954 RFC 9958 RFC 9980 RFC 10024 RFC 10042
- Key Encryption Key (KEK)
A key used to protect other keys, such as the group key that encrypts rekey messages carrying new traffic keys.
Plain language A key used to protect other keys.
Used in RFC 2627 RFC 2631 RFC 3394 RFC 3537 RFC 3565 RFC 4046 RFC 5275 RFC 8418 RFC 8696 RFC 8871 RFC 9048 RFC 9629 RFC 9642 RFC 9690 RFC 9838
- Key escrow
A situation where a key authority holds copies of user's keys and could in principle decrypt their communications.
Plain language A situation where a key authority holds copies of user keys and could decrypt communications.
- Key Exchange
The process of exchanging cryptographic values (K_c1 and K_s1) between client and server. Both parties use these values plus their password-derived secret to compute a shared session secret.
Plain language The process of exchanging cryptographic values so both parties can compute a shared session secret.
Used in RFC 2409 RFC 3565 RFC 3766 RFC 4162 RFC 4432 RFC 5647 RFC 5932 RFC 6954 RFC 7027 RFC 7568 RFC 7664 RFC 8120 RFC 8125 RFC 8268 RFC 8731 RFC 9370
- Key fingerprint
A hash of a public key packet that identifies the key. In OpenPGP its length and hash depend on the key version.
Plain language A hash of a public key packet that identifies the key.
An optional system component, typically colocated with an RA or CA, that generates key pairs for end entities that cannot do so themselves. It signs the delivered key package using a certificate with the id-kp-cmKGA extended key usage.
- Key localization
Turning one user password into a different secret key for each managed engine, by hashing the password-derived key together with that engine's identifier. A leak of one localized key does not reveal the others.
Plain language Turning one password into different secrets for each device by hashing it with the device's identifier.
- Key management
The practice of generating, storing, distributing, using, rotating and retiring cryptographic keys, including the policy that decides when a key is no longer used.
Plain language Everything involved in looking after cryptographic keys over their lifetime.
- Key management protocol
A protocol run before a security protocol starts. It securely establishes the keys and parameters, such as cipher and authentication algorithms, that the security protocol will use.
Plain language A protocol run before a security protocol starts to establish keys and parameters.
- Key Management Service (KMS)
A trusted authority that holds a master secret and uses it to issue private keys to routers. Also holds the public key that all routers use for verification.
Plain language A trusted authority that holds a master secret and issues private keys to routers.
- Key rollover
Replacing a key in use with a new one. When old and new keys are valid together for a while, the change can happen without interrupting communication.
Plain language Replacing a key in use with a new one, with both valid together for a time.
Used in RFC 4641 RFC 6489 RFC 6781 RFC 7645 RFC 8177 RFC 8901 RFC 9691
- Key signing key (KSK)
A key whose private half signs other keys in a zone, typically the zone signing key. It may have a longer lifetime. Which key is a KSK is an operational choice, not something validation tells apart.
Plain language A key whose private half signs other keys in a zone, possibly with longer lifetime.
Used in RFC 2523 RFC 4033 RFC 5011 RFC 5933 RFC 6781 RFC 7344 RFC 7583 RFC 8078 RFC 8145 RFC 8483 RFC 8509 RFC 8624 RFC 8806 RFC 8901 RFC 9718 RFC 9904 RFC 9975
- Key tag
A 16-bit value computed from a DNSKEY's data. It helps pick the right key among several but is not guaranteed to be unique.
Plain language A 16-bit value computed from a DNSKEY, helping pick the right key among several.
Used in RFC 2535 RFC 3658 RFC 4034 RFC 4398 RFC 5702 RFC 5910 RFC 8145 RFC 8509
- Key Usage
An X.509 certificate extension whose bits say what the certificate's public key may be used for, such as signing certificates, signing revocation lists, or encrypting data.
Plain language The part of a certificate that says what its key is allowed to be used for.
- Key wrap
A way of encrypting one cryptographic key with another key so that it can be sent safely alongside a message.
Plain language Encrypting one cryptographic key with another so it can be sent safely.
Used in RFC 3217 RFC 3370 RFC 3394 RFC 3537 RFC 3565 RFC 3657 RFC 4010 RFC 4490 RFC 4962 RFC 5649 RFC 5753 RFC 5959 RFC 6033 RFC 6063 RFC 6318 RFC 9052 RFC 9053 RFC 9173
- Key Wrapping
Encrypting one cryptographic key with another so that it can be sent safely. In LISP-SEC the one-time key is wrapped with AES Key Wrap.
Plain language Encrypting one cryptographic key with another for safe transmission.
- Keying material (KEYMAT)
The pool of secret bits produced by the Diffie-Hellman exchange. Keys for HIP and for ESP are drawn from it in a fixed order, starting from an index.
Plain language The pool of secret bits produced by a Diffie-Hellman exchange, from which session keys are drawn.
- Keying material exporter
A function that lets an application derive its own keys from an existing TLS session. It takes a label, an optional context and a length, and returns that many bytes that look random.
Plain language A function that lets an application derive its own keys from an existing TLS session.
- KeyNote
A trust-management system in which credentials are signed statements that bind public keys to authorization rules. The peer evaluates the rules when the sender later makes a request.
Plain language A trust-management system whose credentials say which key is allowed to do what.
- KeyPackage
A bundle of a client's public keys and credentials that the client uploads to the Delivery Service so others can add them to groups.
Plain language A bundle of a client's public keys and credentials uploaded so others can add them to groups.
- Keystream
The sequence of pseudorandom bytes that a stream cipher produces from its key and nonce. It is XORed with the plaintext to encrypt and with the ciphertext to decrypt.
- Kiss-o'-Death
An NTP reply with stratum 0 whose reference ID holds a four-character ASCII kiss code, such as DENY, RSTR or RATE, telling the client to stop or slow down.
Plain language An NTP reply with a four-character ASCII code telling the client to stop or slow down.
- known_hosts
The file in which an SSH client records the host keys of servers it has connected to. On a later connection the client compares the key the server presents with the stored one and warns if they differ.
Plain language A file where an SSH client records server host keys to detect changes on reconnection.
Used in RFC 4253