What PKI element centralizes generation and storage of cryptographic keys?

What PKI element centralizes generation and storage of cryptographic keys?

• A. Key management system
• B. Certificate
• C. Entropy
• D. PRNG

Answer: (A)

The element that centralizes generation and storage of cryptographic keys is a Key Management System. A KMS provides a centralized place to create keys, protect them in storage (often using hardware security modules or secure enclaves), control who can access and use them, and manage their entire lifecycle—rotation, deletion, backup, and auditing. In PKI, while a Certificate Authority issues certificates that bind identities to public keys, the private keys themselves are typically generated and kept within the KMS (often hardware-backed) to ensure they remain secure and under strict policy enforcement. This centralized approach is essential for maintaining consistent security controls across the infrastructure. Entropy and PRNGs are about generating randomness for key creation, not about managing or storing keys themselves. A certificate represents a public key bound to an identity, but it does not centralize key generation or storage.

The element that centralizes generation and storage of cryptographic keys is a Key Management System. A KMS provides a centralized place to create keys, protect them in storage (often using hardware security modules or secure enclaves), control who can access and use them, and manage their entire lifecycle—rotation, deletion, backup, and auditing. In PKI, while a Certificate Authority issues certificates that bind identities to public keys, the private keys themselves are typically generated and kept within the KMS (often hardware-backed) to ensure they remain secure and under strict policy enforcement. This centralized approach is essential for maintaining consistent security controls across the infrastructure.

Entropy and PRNGs are about generating randomness for key creation, not about managing or storing keys themselves. A certificate represents a public key bound to an identity, but it does not centralize key generation or storage.