Which is a valid requirement for secure crypto key storage?

• A. Keys must be stored in plaintext on servers
• B. Keys must be stored securely and separated from data keys
• C. Keys must be distributed to all developers
• D. Keys must be stored in public cloud storage

Answer: (B)

Protect cryptographic keys by keeping them secure and separate from the data they protect. Using a secure key store (such as a hardware security module or a dedicated key management service) with strong access controls, rotation, and auditing is the right approach. This setup supports envelope encryption, where data is encrypted with a data key and that data key is itself encrypted with a master key stored securely. If ciphertext is stolen, the data remains protected without the corresponding keys.

Storing keys in plaintext on servers is risky because anyone who gains access to those servers could decrypt the data. Distributing keys to all developers increases the chance of leakage and violates least-privilege principles. Storing keys in public cloud storage is inappropriate unless that storage is tightly protected with proper controls, which is not the standard or most secure practice.