Keys and passwords: why losing one breaks everything

Every lesson in this course has quietly depended on the same assumption: the right key stayed with the right person. Symmetric encryption fails the moment its shared key leaks. Asymmetric encryption fails if a private key is exposed. A signature means nothing once its private key is stolen — an attacker can now sign anything and it will verify as genuine. The NCAE-C Basic Cryptography knowledge unit lists key management, alongside the algorithms themselves, as an issue that “must be addressed before implementation” — not an afterthought.

Why a strong algorithm does not save a weak key

AES with a 256-bit key is, for practical purposes, unbreakable by guessing. None of that matters if the key itself is written on a sticky note, reused across accounts, or protected by a four-digit code an attacker can try in seconds. Most real-world cryptographic failures are not broken algorithms; they are exposed keys, reused passwords, or secrets left in plain text where they should have been protected. This is why the previous lessons’ guarantees always came with a condition attached — “if the shared key stays secret”, “only the holder of the private key” — that condition is where key management lives.

What current password guidance actually says

NIST’s current digital identity guidelines (SP 800-63B) reverse much of the advice many people were taught. Verifiers, it says, “SHALL NOT require subscribers to change passwords periodically” and should not impose composition rules forcing mixes of character types — both practices that pushed people toward small, predictable variations rather than genuinely stronger passwords. Instead, NIST recommends longer passwords (its guidance points toward a minimum in the range of eight to fifteen characters depending on context, with a maximum of at least 64 allowed) and checking new passwords against lists of commonly breached or expected passwords rather than demanding artificial complexity. It also explicitly requires that verifiers “allow the use of password managers and autofill functionality”, including permitting paste into password fields — recognising that a tool generating and storing unique, long passwords per site does more for security than any rule a person can be expected to follow by memory.

Passkeys: removing the shared secret entirely

A password is a shared secret: both you and the service know it, which is exactly what makes it phishable — a fake login page just asks for the same secret. A passkey avoids this by using the asymmetric encryption from earlier in this course. Apple’s support documentation describes the process: your device generates “a unique cryptographic key pair” when you create a passkey — a public key that goes to the service, and a private key that never leaves your device. Apple states passkeys are resistant to phishing because there is no shared secret to trick you into typing: the private key simply cannot be extracted by a fake website, no matter how convincing it looks. On Apple devices, the private key is protected and synced across your own devices through iCloud Keychain, which Apple describes as end-to-end encrypted so that Apple itself does not hold the key.

CISA’s hierarchy of factors, in short

Guidance from the US Cybersecurity and Infrastructure Security Agency on multi-factor authentication ranks methods by resistance to phishing. It states that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication” — the same underlying standard passkeys are built on. A one-time code sent by text message is, in its words, still much better than no second factor at all, but it can be relayed or intercepted in ways a phishing-resistant method cannot. Where a service offers a passkey or a FIDO security key, it is currently the strongest widely available option; where it only offers app-based codes or SMS, either is still meaningfully better than a password alone.

A practical takeaway

Use a password manager, so every account gets a long, unique password you never have to remember. Turn on the strongest available second factor — a passkey or a physical security key where offered, an authenticator app otherwise. And treat any moment a password or key was possibly exposed — a phishing click, a lost device, a breach notice — as something to act on immediately, not later: change the credential, and check whether it was reused anywhere else.