Key Points

When selecting keys, make sure that they are generated randomly. The strength of the algorithm is dependent on random keys. Do not assume that random number functions produce good random numbers. Do your homework before selecting a PRNG or pseudo-random number generator. Perform proper key management. Do not do the following:

Use the same cryptographic key for multiple purposes.

Share the same key with multiple parties.

Use the same key for an extended time or past its key life.

Reuse the keystream when using stream ciphers.

We close this chapter by reemphasizing the major points covered. Use cryptographic primitives and protocols for their designed purpose, and ensure that you follow any specific directions or qualifiers. Unless you are a cryptographer, do not "roll" your own cryptography. Encryption is not the same as authentication or integrity. Cryptographic techniques may be used to accomplish all three, but they are distinct activities. Finally, cryptography is a tool to assist in building secure applications and systems, not a security solution on its own.