cryptographic device. See fill device. master key - key from which all other keys (or a large group of keys) can be derived. Analogous to a physical key that can open all the doors in a building. master encryption key (MEK) - Used to encrypt the DEK/TEK key. master key encryption key (MKEK) - Used to encrypt multiple KEK keys. For example, an HSM can generate several KEK and wrap them with an MKEK before export to an external DB - such as OpenStack Barbican. one time pad (OTP or OTPad) - keying material that should be as long as the plaintext and should only be used once. If truly random and not reused it's the most secure encryption method. See one-time pad article. one time password (OTP) - One time password based on a prebuilt single use code list or based on a mathematical formula with a secret seed known to both parties, uses event or time to modify output (see TOTP/HOTP). paper key - (NSA) keys that are distributed in paper form, such as printed lists of settings for rotor machines, or keys in punched card or paper tape formats. Paper keys are easily copied. See Walker spy ring, RED key. poem key - Keys used by OSS agents in World War II in the form of a poem that was easy to remember. See Leo Marks. Public/private key - in public key cryptography, separate keys are used to encrypt and decrypt a message. The encryption key (public key) need not be kept secret and can be published. The decryption or private key must be kept secret to maintain confidentiality. Public keys are often distributed in a signed public key certificate. pre-placed key - (NSA) large numbers of keys (perhaps a year's supply) that are loaded into an encryption device allowing frequent key change without refill. RED key - (NSA) symmetric key in a format that can be easily copied, e.g. paper key or unencrypted electronic key. Opposite of BLACK or benign key. revoked key - a public key that should no longer be used, typically because its owner is no longer in the role for which it was issued or because it may have been compromised. Such keys are placed on a certificate revocation list or CRL. session key - key used for one message or an entire communications session. See traffic encryption key. symmetric key -