Secrets and encryption terms, explained
Short, plain definitions of the terms you meet when you manage secrets for a team: encryption, keys, signatures, access, and the habits around them.
25 terms
Terms starting with A
AES-256-GCM
AES-256-GCM is the AES block cipher with a 256-bit key used in Galois/Counter Mode, an authenticated encryption method that keeps data confidential and lets the recipient detect if even one bit of the ciphertext was changed.
Audit log hash chain
An audit log hash chain is a way of storing log entries so that each entry includes a cryptographic hash of the entry before it, which makes any later edit, deletion or insertion in the middle of the log detectable.
Terms starting with B
Break-glass access
Break-glass access is a pre-arranged way for an authorized person to bypass a normal security control during an emergency, on the condition that the bypass is short, requires a stated reason and is visible to everyone who reviews the logs.
Terms starting with C
CIDR allowlist
A CIDR allowlist is a list of IP address ranges, written in CIDR notation, from which a service accepts certain requests, so that a valid credential used from anywhere else is refused.
Client-side encryption
Client-side encryption means data is encrypted on the user's own device, before it is sent anywhere, with keys that the receiving server never gets.
Terms starting with D
Digital signature
A digital signature is a value computed from data with a private key, which anyone holding the matching public key can check, showing that the data was signed with that key and has not changed since.
Terms starting with E
Ed25519
Ed25519 is a digital signature scheme, the Edwards-curve Digital Signature Algorithm on the edwards25519 curve, that lets anyone holding a public key check that a message was signed by the matching private key and has not changed since.
Emergency Kit
An Emergency Kit is a document, printed or saved as a PDF, that holds what you need to sign in to an encrypted account on a new device, above all a Secret Key that the service itself does not keep.
End-to-end encryption
End-to-end encryption is a design in which data is encrypted by the sender and decrypted only by the intended recipients, so every system in between, including the service's own server, handles nothing but ciphertext.
Envelope encryption
Envelope encryption is the practice of encrypting data with one key, called a data key, and then encrypting that data key with a second key, so that access can be granted or changed by handling the small wrapped key rather than re-encrypting all the data.
Environment variable
An environment variable is a named text value, such as LOG_LEVEL=debug, that the operating system hands to a program when the program starts, so the same code can behave differently on a laptop, in CI and in production.
Terms starting with K
Key derivation
Key derivation is the process of turning an input that is not a usable key on its own, such as a password, into a fixed-length cryptographic key, in a way that is repeatable for the right input and expensive to guess for the wrong one.
Key rotation
Key rotation is replacing a cryptographic key with a new one and protecting data under the new key from then on, so that anyone who obtained the old key cannot read what is written after the change.
Terms starting with L
Least privilege
Least privilege is the security principle that every user, process and system should have only the access needed for its task, and nothing more.
Terms starting with O
Offboarding
Offboarding is the process of ending a person's access when they leave a team or a project: removing their accounts and permissions, collecting what they carried with them, and replacing any secrets they could have read.
OIDC for CI
OIDC for CI is the use of OpenID Connect identity tokens, short-lived signed JWTs that a CI provider issues to a running job, so the job can prove where it runs instead of presenting a long-lived stored secret.
One-time link
A one-time link is a URL that delivers a secret to someone and then stops working, after a single view or a short time, so the secret does not sit in a chat history or inbox where anyone with later access can read it.
Terms starting with P
Public key fingerprint
A public key fingerprint is a short string computed from a public key with a hash function, short enough for two people to read aloud or compare on two screens, so they can confirm they are looking at the same key.
Terms starting with R
Rollback protection
Rollback protection is a set of checks that stop a client from accepting data that is older than what it has already seen, even when that older data carries valid signatures.
Terms starting with S
Secret
A secret is any value that lets its holder act as someone or reach something, such as an API key, a database password, a cloud access key, a signing key or a session token, so that anyone who copies it gains the same power without asking.
Secret Key
A Secret Key is a long random value generated on your device when you create an account, which is combined with your password to derive the key that protects your data, so that neither your password nor the Secret Key alone is enough.
Secrets vault
A secrets vault is a service that keeps a team's credentials and sensitive configuration in one place, encrypted, and hands each person, server or pipeline only the values it is allowed to read, while recording who received what.
Service token
A service token is a credential issued to software rather than to a person, typically a CI pipeline or a script, that lets it authenticate to a service and read only what it has been granted.
Terms starting with X
X25519
X25519 is a key agreement function on the elliptic curve Curve25519 that lets two parties, each holding a private key and the other's public key, compute the same shared secret without ever sending that secret over the network.
Terms starting with Z
Zero-knowledge architecture
“Zero-knowledge architecture” is an industry label for services built so that the provider cannot read what customers store, because encryption keys are created and kept on customers' devices rather than on the provider's servers.