Glossary
K
25 terms.
- Keep-alive
A small message sent regularly over a connection to keep a NAT or firewall binding open and to learn whether the connection still works.
Like I'm five A quick "still there?" message so the line does not go quiet and get closed.
- Keepalive
A small message sent periodically so that a NAT, firewall or peer does not decide a connection is idle and forget it.
Like I'm five A quick wave every so often so the other side knows you are still there.
- Kerberos
A network authentication protocol in which a trusted Key Distribution Center issues tickets so clients and servers can prove their identities without sending passwords over the network. Version 5 is specified in RFC 4120.
Like I'm five A trusted helper who gives out passes so you can prove who you are without telling your secret to everyone.
Used in RFC 1176 RFC 1282 RFC 1409 RFC 1411 RFC 1416 RFC 1487 RFC 1507 RFC 1511 RFC 1704 RFC 1731 RFC 1813 RFC 1823 RFC 1943 RFC 1961 RFC 1964 RFC 2025 RFC 2078 RFC 2094 RFC 2193 RFC 2196 RFC 2203 RFC 2222 RFC 2228 RFC 2355 and 99 more
- Key chain
A named list of keys, each with a Key ID, key string, algorithm and lifetimes. It acts as a reusable key policy that protocols can refer to by name.
Like I'm five A ring of keys where each key has dates for when it works.
- Key derivation
A function that turns a master key into several independent session keys. SRTP uses AES in counter mode as the pseudo-random function.
Like I'm five Making many different keys from one secret.
Used in RFC 2082 RFC 2144 RFC 2274 RFC 2523 RFC 2631 RFC 2828 RFC 2898 RFC 3185 RFC 3211 RFC 3370 RFC 3711 RFC 3748 RFC 3766 RFC 3826 RFC 3830 RFC 3957 RFC 3961 RFC 3962 RFC 4017 RFC 4107 RFC 4121 RFC 4357 RFC 4401 RFC 4434 and 127 more
- Key Distribution Center
A trusted server that stores encryption keys and issues tickets to authenticated clients and servers, allowing them to prove their identity to each other without direct trust.
Like I'm five A trusted office that knows everyone and gives them proof cards they can show to trust each other.
- Key Distribution Center (KDC)
The trusted Kerberos server that holds every principal's secret key and issues tickets. It combines the Authentication Service (AS) and the Ticket-Granting Service (TGS).
Like I'm five The helper who keeps the book of everybody's secrets and hands out passes.
Used in RFC 1510 RFC 1964 RFC 2094 RFC 2230 RFC 2712 RFC 3244 RFC 3634 RFC 3962 RFC 4101 RFC 4120 RFC 4121 RFC 4430 RFC 4537 RFC 4556 RFC 4557 RFC 4757 RFC 5021 RFC 5868 RFC 5896 RFC 6111 RFC 6113 RFC 6251 RFC 6448 RFC 6560 and 10 more
- Key encapsulation mechanism
A KEM lets one party use another's public key to create a fresh shared secret and a ciphertext that only the key holder can open. ML-KEM is one example.
Like I'm five One person sends a locked box that holds a secret, and only the person with the right key can open it.
Used in RFC 9180 RFC 9629 RFC 9690 RFC 9794 RFC 9810 RFC 9935 RFC 9954 RFC 9958 RFC 9980 RFC 10024 RFC 10042
- Key Encryption Key (KEK)
A key used to protect other keys, such as the group key that encrypts rekey messages carrying new traffic keys.
Like I'm five A key whose only job is to lock up other keys.
Used in RFC 2627 RFC 2631 RFC 3394 RFC 3537 RFC 4046 RFC 5275 RFC 8418 RFC 8696 RFC 8871 RFC 9629 RFC 9642 RFC 9690
- Key escrow
A situation where a key authority holds copies of user's keys and could in principle decrypt their communications.
Like I'm five A third party could read all your messages if they wanted.
- Key Exchange
The process of exchanging cryptographic values (K_c1 and K_s1) between client and server. Both parties use these values plus their password-derived secret to compute a shared session secret.
Like I'm five Swapping secret numbers so both sides can compute a shared secret.
- Key fingerprint
A hash of a public key packet that identifies the key. In OpenPGP its length and hash depend on the key version.
Like I'm five A long number that works like a fingerprint for a key, so you can tell keys apart.
- Key localization
Turning one user password into a different secret key for each managed engine, by hashing the password-derived key together with that engine's identifier. A leak of one localized key does not reveal the others.
Like I'm five Mixing your one password with each device's name so every device gets its own secret.
- Key management protocol
A protocol run before a security protocol starts. It securely establishes the keys and parameters, such as cipher and authentication algorithms, that the security protocol will use.
Like I'm five The part where two people agree on the secret code before they start talking.
- Key Management Service (KMS)
A trusted authority that holds a master secret and uses it to issue private keys to routers. Also holds the public key that all routers use for verification.
Like I'm five The trusted central office that gives each router its signing key once, then goes offline.
- Key rollover
Replacing a key in use with a new one. When old and new keys are valid together for a while, the change can happen without interrupting communication.
Like I'm five Swapping to a new key while the old one still works for a bit.
- Key signing key (KSK)
A key whose private half signs other keys in a zone, typically the zone signing key. It may have a longer lifetime. Which key is a KSK is an operational choice, not something validation tells apart.
Like I'm five The boss key that only signs other keys.
Used in RFC 2523 RFC 4033 RFC 5011 RFC 5933 RFC 6781 RFC 7344 RFC 7583 RFC 8078 RFC 8145 RFC 8483 RFC 8509 RFC 8624 RFC 8806 RFC 8901 RFC 9718 RFC 9904 RFC 9975
- Key tag
A 16-bit value computed from a DNSKEY's data. It helps pick the right key among several but is not guaranteed to be unique.
Like I'm five A short nickname for a key that helps find it fast, but two keys can share one.
Used in RFC 2535 RFC 3658 RFC 4034 RFC 4398 RFC 5702 RFC 5910 RFC 8145 RFC 8509
- Key wrap
A way of encrypting one cryptographic key with another key so that it can be sent safely alongside a message.
Like I'm five Locking a small key inside a box so you can mail it safely.
Used in RFC 3217 RFC 3370 RFC 3394 RFC 3537 RFC 3565 RFC 3657 RFC 4010 RFC 4490 RFC 4962 RFC 5649 RFC 5753 RFC 5959 RFC 6063 RFC 6318 RFC 9052 RFC 9053 RFC 9173
- Key Wrapping
Encrypting one cryptographic key with another so that it can be sent safely. In LISP-SEC the one-time key is wrapped with AES Key Wrap.
Like I'm five Putting a secret key in a locked box before mailing it.
- Keying material (KEYMAT)
The pool of secret bits produced by the Diffie-Hellman exchange. Keys for HIP and for ESP are drawn from it in a fixed order, starting from an index.
Like I'm five A big pile of secret bits that the two computers cut keys from.
- Keying material exporter
A function that lets an application derive its own keys from an existing TLS session. It takes a label, an optional context and a length, and returns that many bytes that look random.
Like I'm five A machine that turns one shared secret into as many new secrets as you ask for.
- KeyPackage
A bundle of a client's public keys and credentials that the client uploads to the Delivery Service so others can add them to groups.
Like I'm five A sealed envelope with your public lock and a note from the security guard saying you are who you claim to be.
- Kiss-o'-Death
An NTP reply with stratum 0 whose reference ID holds a four-character ASCII kiss code, such as DENY, RSTR or RATE, telling the client to stop or slow down.
Like I'm five A short code word from a server that means, please stop asking so much.
- known_hosts
The file in which an SSH client records the host keys of servers it has connected to. On a later connection the client compares the key the server presents with the stored one and warns if they differ.
Like I'm five A notebook where your computer writes down what each server's signature looks like.
Used in RFC 4253