Blog

Categories:

13. 7. 2026

Cryptography

What secrets does a secret hide?

Different forms of secrets are used in the field of computer systems. Some secrets are created by humans (passwords or PINs), others are generated or derived by algorithms (cryptographic keys). Although we encounter them daily, their meaning and correct use are often confused. This article provides a brief glossary of the most important terms?
The secrets mentioned are usually stored in a way that is supposed to protect them adequately. Some keys remain only temporarily stored in memory, others are stored either as files without protection or with some layer of protection (for example, using a password). Others are stored on specialized devices, such as HSM (Hardware Security Module). In the case of storage using software, forms of password databases or specialized software called KMS (Key Management Software) are usually used. There is a big difference between these levels of protection, which will be described in one of the next articles.

Secret

A secret is any information that must remain private. It can be a password, a cryptographic key, a private key, an API key, or a recovery code, for example. The secret itself does not have to be random - a typical example is a password created by a person. However, cryptographic secrets should be generated in a way that ensures high randomness, unpredictability, and sufficient entropy. KDF or CSPRNG are usually used for this. Terms such as randomness, unpredictability, and entropy can be explained as:

Randomness describes the way a secret is generated. A good generator generates values without an obvious pattern and with approximately the same probability of occurrence of individual values. Humans, on the other hand, add at least subconscious relationships, generators try to prevent this property.
Unpredictability expresses the attacker's ability to guess the next value. Even if the output looks random, it may not be safe if it can be calculated. A quality generator must therefore also provide unpredictable values.
Entropy expresses the degree of uncertainty, i.e. the number of possible values. It is usually given in bits. Longer secrets tend to have higher entropy, but length alone does not guarantee it.

Password

A password is a secret created by a person. It usually contains words, patterns, or personal information, and therefore has lower entropy than a randomly generated value of the same length. A password should never be used directly as a cryptographic key. On the contrary, the password should serve as an input that is converted by a KDF (e.g. Argon2 or PBKDF2) into a key suitable for cryptographic algorithms.

Passphrase

A passphrase is a longer password consisting of several words. Due to its greater length and number of possible combinations, it can provide higher entropy while maintaining good memorability. At the same time, it is possible to deliberately introduce grammatical errors or replace, add or delete certain characters or groups of characters into these words. These changes can increase unpredictability, but they must be used with caution.

A PIN (Personal Identification Number) is a short authentication data, usually 4 to 6 digits long. It is used, for example, to unlock a phone, a payment card, or a hardware token.

Key material

Key material is a set of sensitive cryptographic data used to create, derive, store, or use keys. This includes, for example, master keys, private keys, shared secrets, or seeds. It may also include some auxiliary values used when working with keys.

Cryptographic key

A cryptographic key is a binary value used by a cryptographic algorithm. Unlike a password, it is not intended for a person, but for an algorithm. Keys are usually generated by a cryptographically secure random number generator (CSPRNG) or derived using a KDF. In the case of asymmetric keys, there is also a requirement for additional mathematical properties, so the generator is significantly more complex in this case.

Shared key

A shared key is known to two or more parties. It is used primarily in symmetric cryptography to ensure confidentiality and data integrity.

Private and public key

Asymmetric cryptography uses a pair of keys. The public key can be safely published and is used, for example, for encryption or verification of digital signatures. The private key must remain secret and is used for decryption or creation of digital signatures. There is a simple relationship between the private and public keys, the public key is generated from the private one. This creates a mathematical link between the keys.

Key pair

A key pair consists of a corresponding public and private key. The public key is derived from the private key, there is a mathematical relationship between these members of the pair.

Master Key

The master key from which other cryptographic keys are derived. Other secrets, such as a Seed, can be used as input for the derivation.

Key Encryption Key(KEK)

A key designed to encrypt other cryptographic keys. It is used in places where a local key database is created for easier management, this database is encrypted using KEK. The key database is relatively small, changing its keys is easy. In contrast, changing the key material for all blocks of data could mean disproportionately high computational requirements.

Data Encryption Key (DEK)

A key used to encrypt and subsequently decrypt user data.

Seed

An initial value from which other keys can be deterministically created. The seed itself is usually not used directly for encryption.

IV (Initialization Vector)

An initialization vector that adjusts the course of the encryption algorithm. It is usually not secret and must meet the requirements of the specific algorithm.

Nonce

A one-time value (number used once). Usually not secret, but may not be reused where the algorithm does not require it. In the case of a nonce, a good example of the possible impacts of nonce reuse in the AES-GCM algorithm is that in 2016 it allowed decryption of part of cryptographically protected information. The same threat is nonce reuse for ECDSA algorithms, where if the same nonce is used for two texts or two different nonces for one text, it is possible to calculate the private key.

Salt and Pepper

A salt is a public random value added to a password before it is processed. It prevents identical passwords from producing identical results. Pepper is an additional secret kept separately from the password database and provides an additional layer of protection.

KDF (Key Derivation Function)

An algorithm for deriving cryptographic keys from passwords or other keys. Modern KDFs (e.g., Argon2) intentionally slow down the calculation, thereby increasing resistance to brute force attacks.

Hash

A hash function converts input data into a fixed-length fingerprint. It is used to check data integrity and, together with KDFs, also for securely storing passwords.

CSPRNG

A Cryptographically Secure Pseudo-Random Number Generator is used for generating keys, nonces, and other cryptographic values. It is an algorithm designed to generate a sequence of bits that behaves in a truly random and unpredictable manner for practical purposes, while its behavior is based on an initial setting. Such a generator must have additional security-enhancing properties. These include resistance to compromise (this applies mainly to hardware generators) and resistance to deriving initialization from the generator output.

Conclusion

It is advisable to keep secrets to yourself. But the description of how secrets are handled is not one of these secrets. If we are not able to understand and use these terms, we risk misunderstandings that can ultimately jeopardize the secure operation of cryptography.

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.

1. Introductory Provisions

1.1. These General Terms and Conditions are, unless otherwise agreed in writing in the contract, an integral part of all contracts relating to training organised or provided by the trainer, Jan Dušátko, IČ 434 797 66, DIČ 7208253041, with location Pod Harfou 938/58, Praha 9 (next as a „lector“).
1.2. The contracting parties in the general terms and conditions are meant to be the trainer and the ordering party, where the ordering party may also be the mediator of the contractual relationship.
1.3. Issues that are not regulated by these terms and conditions are dealt with according to the Czech Civil Code, i.e. Act No.89/2012 Coll.
1.4. All potential disputes will be resolved according to the law of the Czech Republic.

2. Creation of a contract by signing up for a course

2.1. Application means unilateral action of the client addressed to the trainer through a data box with identification euxesuf, e-mailu with address register@cryptosession.cz or register@cryptosession.info, internet pages cryptosession.cz, cryptosession.info or contact phone +420 602 427 840.
2.2. By submitting the application, the Client agrees with these General Terms and Conditions and declares that he has become acquainted with them.
2.3. The application is deemed to have been received at the time of confirmation (within 2 working days by default) by the trainer or intermediary. This confirmation is sent to the data box or to the contact e-mail.
2.4. The standard time for registration is no later than 14 working days before the educational event, unless otherwise stated. In the case of a natural non-business person, the order must be at least 28 working days before the educational event.
2.5. More than one participant can be registered for one application.
2.6. If there are more than 10 participants from one Client, it is possible to arrange for training at the place of residence of the intermediary or the Client.
2.7. Applications are received and processed in the order in which they have been received by the Provider. The Provider immediately informs the Client of all facts. These are the filling of capacity, too low number of participants, or any other serious reason, such as a lecturer's illness or force majeure. In this case, the Client will be offered a new term or participation in another educational event. In the event that the ordering party does not agree to move or participate in another educational event offered, the provider will refund the participation fee. The lack of participants is notified to the ordering party at least 14 days before the start of the planned term.
2.8. The contract between the provider and the ordering party arises by sending a confirmation from the provider to the ordering party.
2.9. The contract may be changed or cancelled only if the legal prerequisites are met and only in writing.

3. Termination of the contract by cancellation of the application

3.1. The application may be cancelled by the ordering party via e-mail or via a data mailbox.
3.2. The customer has the right to cancel his or her application for the course 14 days before the course takes place without any fees. If the period is shorter, the subsequent change takes place. In the interval of 7-13 days, an administrative fee of 10% is charged, cancellation of participation in a shorter interval than 7 days then a fee of 25%. In case of cancellation of the application or order by the customer, the possibility of the customer's participation in an alternative period without any additional fee is offered. The right to cancel the application expires with the implementation of the ordered training.
3.3. In case of cancellation of the application by the trainer, the ordering party is entitled to a full refund for the unrealized action.
3.4. The ordering party has the right to request an alternative date or an alternative training. In such case, the ordering party will be informed about all open courses. The alternative date cannot be enforced or enforced, it depends on the current availability of the course. If the alternative training is for a lower price, the ordering party will pay the difference. If the alternative training is for a lower price, the trainer will return the difference in the training prices to the ordering party.

4. Price and payment terms

4.1. By sending the application, the ordering party accepts the contract price (hereinafter referred to as the participation fee) indicated for the course.
4.2. In case of multiple participants registered with one application, a discount is possible.
4.3. The participation fee must be paid into the bank account of the company held with the company Komerční banka č. 78-7768770207/0100, IBAN:CZ5301000000787768770207, BIC:KOMBCZPPXXX. When making the payment, a variable symbol must be provided, which is indicated on the invoice sent to the client by the trainer.
4.4. The participation fee includes the provider's costs, including the training materials. The provider is a VAT payer.
4.5. The client is obliged to pay the participation fee within 14 working days of receipt of the invoice, unless otherwise stated by a separate contract.
4.6. If the person enrolled does not attend the training and no other agreement has been made, his or her absence is considered a cancellation application at an interval of less than 7 days, i.e. the trainer is entitled to a reward of 25% of the course price. The overpayment is returned within 14 days to the sender's payment account from which the funds were sent. Payment to another account number is not possible.
4.7. An invoice will be issued by the trainer no later than 5 working days from the beginning of the training, which will be sent by e-mail or data box as agreed.

5. Training conditions

5.1. The trainer is obliged to inform the client 14 days in advance of the location and time of the training, including the start and end dates of the daily programme.
5.2. If the client is not a student of the course, he is obliged to ensure the distribution of this information to the end participants. The trainer is not responsible for failure to comply with these terms and conditions.
5.2. By default, the training takes place from 9 a.m. to 5 p.m. at a predetermined location.
5.3. The trainer can be available from 8 a.m. to 9 a.m. and then from 17 a.m. to 6 p.m. for questions from the participants, according to the current terms and conditions.
5.4. At the end of the training, the certificate of absorption is handed over to the end users.
5.5. At the end of the training, the end users evaluate the trainer's approach and are asked to comment on the evaluation of his presentation, the manner of presentation and the significance of the information provided.

6. Complaints

6.1. If the participant is grossly dissatisfied with the course, the trainer is informed of this information.
6.2. The reasons for dissatisfaction are recorded in the minutes in two copies on the same day. One is handed over to the client and one is held by the trainer.
6.3. A statement on the complaint will be submitted by e-mail within two weeks. A solution will then be agreed within one week.
6.4. The customer's dissatisfaction may be a reason for discontinuing further cooperation, or financial compensation up to the price of the training, after deduction of costs.

7. Copyright of the provided materials

7.1. The training materials provided by the trainer in the course of the training meet the characteristics of a copyrighted work in accordance with Czech Act No 121/2000 Coll.
7.2. None of the training materials or any part thereof may be further processed, reproduced, distributed or used for further presentations or training in any way without the prior written consent of the trainer.

8. Liability

8.1. The trainer does not assume responsibility for any shortcomings in the services of any third party that he uses in the training.
8.2. The trainer does not assume responsibility for injuries, damages and losses incurred by the participants in the training events or caused by the participants. Such costs, caused by the above circumstances, shall be borne exclusively by the participant in the training event.

9. Validity of the Terms

9.1 These General Terms and Conditions shall be valid and effective from 1 October 2024.