Which of the following are best practices for symmetric key management?

• A. Share keys over unencrypted email.
• B. Store keys in code repositories.
• C. Use weak keys for compatibility.
• D. Generate securely, store with encryption, rotate regularly, and revoke compromised keys.

Answer: (D)

Handling symmetric keys effectively means treating the key as a highly confidential secret throughout its entire life cycle. The strongest practice is to generate keys with strong, unpredictable randomness, protect them by encryption both at rest and in transit (for example, using a trusted key management service or hardware security module), and control access so only authorized systems and people can use them. Keys should be rotated regularly so that even if a key is exposed, the window of opportunity for misuse is limited. If a key is suspected or known to be compromised, it should be revoked and a new key issued, with old material securely destroyed. This combination—secure generation, encrypted storage, regular rotation, and prompt revocation—provides ongoing protection and rapid response to threats.

Sharing keys over unencrypted email is dangerous because anyone who intercepts the message can obtain the key, defeating confidentiality. Storing keys in code repositories also increases risk of exposure since repositories may be copied, shared, or leaked. Using weak keys makes the encryption far easier to break, eroding the entire security model. Together, those practices fail to provide the necessary safeguards, whereas the recommended approach addresses the full lifecycle and strengthens resilience against key exposure and misuse.