Lion Cipher Lab
Inventory your cryptographic keys and enforce NIST SP 800-57 cryptoperiods
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every TLS certificate, code-signing key, database encryption key, webhook secret and SSH host key in an organisation is a small promise that only the right people can read, sign or log in. Those promises wear out. A key that has been in use for six years has had six years to leak, be copied into a backup, or be left behind on a laptop, and an algorithm that was fine in 2015 (RSA-1024, SHA-1 signatures) is no longer allowed for new protection. NIST SP 800-57 is the standard reference for how long each kind of key should live and how strong it must be, and auditors, PCI assessors and federal…
What you'll learn
- Building a cryptographic key inventory that holds metadata and references, never the keys themselves
- Reading NIST SP 800-57 Part 1 Rev. 5 cryptoperiods, originator-usage and recipient-usage periods
- Mapping algorithm and key size to security strength with SP 800-57 Table 2 and SP 800-131A
- Turning a written key-management policy into an automated Python check
- Spotting dual-use keys, and knowing why an AEAD key is not one
- Measuring compliance before and after remediation, and writing an exception-register entry with an expiry
- Naming what a date-based check cannot see: undiscovered keys and compromise
Steps in this lab
- What a key inventory is, and why a date is a security control
- Set up a working folder and confirm Python runs
- Read what NIST actually says before you write a policy
- Write YOUR policy down: the tailoring choices are yours, not NIST's
- Build the synthetic 40-key inventory
- Write the checker that turns the policy into findings
- Measure the BEFORE state
- Read the passes as carefully as the failures
- Measure what tailoring costs: same keys, two policies
- Remediate, and write an exception for the key that cannot move
- Watch the clean result rot: re-run the same inventory later
- What this check cannot see (and the number that proves it)
- Where post-quantum migration plugs in
- What you built, and where to take it