Engineer Privacy into Identity and Access Systems
Control personal data, metadata, identifiers, correlation, telemetry, inference, release, retention, and deletion across access systems.
Topic index
Cryptography and Data Protection
Learn how cryptographic constructions, key lifecycles, and data governance protect information across its complete lifecycle.
Topic index
Understand this domain
Pomerium coverage
Pomerium uses authenticated transport and managed cryptographic material for access sessions, identity assertions, and TLS. Application owners still choose data classification, storage protection, cryptographic constructions, key custody, retention, deletion, and migration for application data.
Limits
- Encryption does not authorize an actor or prevent an authorized endpoint from exposing plaintext.
- A strong algorithm does not correct weak key custody, nonce reuse, unsafe serialization, or an unauthenticated protocol.
- Storage encryption protects only the threat boundaries that do not also expose the decryption key and authorized runtime.
Primary sources
2 learning paths
Paths for this topic
Protect data with applied cryptography
Learn cryptographic primitives, key systems, data lifecycle controls, storage protection, and migration without inventing protocols.
7 related guides
Guides in this topic
Analyze Side-Channel and Shared-Resource Risk
Model secret-dependent signals and deliberate covert channels across software, shared hardware, protocols, and physical devices.
Design application cryptography
Select a standard construction and define keys, nonces, context, record format, failure behavior, tests, and migration before coding.
Design Information Flow Controls
Define labels, allowed flows, trusted transformations, release policy, evidence, and residual channels across an application and its data systems.
Design Secure Boot and Platform Attestation
Connect roots of trust, boot verification, measurements, fresh evidence, appraisal, policy, update, revocation, and recovery.
Plan a cryptographic migration
Inventory cryptographic dependencies and migrate protocols, algorithms, keys, certificates, code, hardware, and stored data safely.
Protect application data with cryptography
Choose transport, application, database, filesystem, storage, and in-use protections from the data threat model and key boundary.
Protect the data lifecycle
Control collection, use, sharing, storage, logging, backup, recovery, retention, deletion, and sanitization for one data class.
20 related terms
Concepts in this topic
Authenticated Encryption with Associated Data (AEAD)
Encrypt plaintext and authenticate ciphertext plus unencrypted context with a standard AEAD construction and correct nonce handling.
Backup and Restore
Create isolated, complete, recoverable copies and prove they restore current service without old compromise, authority, or expired data.
Cryptographic Agility
Inventory and replace algorithms, parameters, protocols, keys, libraries, certificates, and stored formats without hidden dependencies.
Cryptographic Hash Function
Map data to a fixed-length digest with defined preimage, second-preimage, and collision resistance for the selected use.
Cryptographic Key Management
Control cryptographic key purpose, generation, custody, distribution, use, rotation, compromise, recovery, and destruction.
Cryptographic Randomness and Entropy
Generate unpredictable security values from a validated entropy source and cryptographic random-bit generator with protected state.
Data Classification
Assign data sensitivity, criticality, ownership, use, sharing, retention, and recovery requirements that drive technical controls.
Data Minimization and Purpose Limitation
Collect, use, expose, and retain only the data necessary for a stated operational purpose and bounded period.
Data Retention and Secure Deletion
Retain data for a stated need, then remove access across primary storage, replicas, caches, backups, indexes, keys, and media.
Digital Signature
Bind a defined message to a private signing key and verify it through an authenticated public key, purpose, and context.
Envelope Encryption
Encrypt data with a data-encryption key and protect that key under a separately stored key-encryption key or key service.
Hardware Root of Trust
Anchor a narrow security function in protected hardware while stating the manufacturing, firmware, key, lifecycle, and physical assumptions that remain.
Key Derivation Function (KDF)
Derive purpose-separated cryptographic keys from suitable key material with a standard KDF, salt, context, and output length.
Key Management Service and HSM
Separate key lifecycle orchestration, hardware protection, cryptographic operations, workload authorization, and application data policy.
Message Authentication Code (MAC)
Verify message integrity and shared-key origin with a standard MAC while controlling key scope, context, replay, and verification.
Nonce and Initialization Vector
Apply the exact uniqueness, unpredictability, length, and state rules that a cryptographic construction requires for each key.
Personal Data and Metadata
Treat identifiers, device facts, access events, relationships, timing, locations, and derived attributes as personal when context can link them to people.
Post-Quantum Cryptography
Prepare public-key systems for quantum-resistant key establishment and signatures through inventory, standards, testing, and migration.
Secure System Decommissioning
Remove a system, route, identity, key, dependency, and data without leaving reachable shadow service or breaking another security control.
Side-Channel Attack
Analyze information leaked through time, caches, memory access, power, emissions, sound, faults, resources, and error behavior.
