This glossary lists types of keys as the term is used in cryptography, as opposed to door locks. Terms that are primarily used by the U.S. National Security Agency are marked (NSA). For classification of keys according to their usage see cryptographic key types. 40-bit key - key with a length of 40 bits, once the upper limit of what could be exported from the U.S. and other countries without a license. Considered very insecure. See key size for a discussion of this and other lengths. authentication key - Key used in a keyed-hash message authentication code, or HMAC. benign key - (NSA) a key that has been protected by encryption or other means so that it can be distributed without fear of its being stolen. Also called BLACK key. content-encryption key (CEK) a key that may be further encrypted using a KEK, where the content may be a message, audio, image, video, executable code, etc. crypto ignition key An NSA key storage device (KSD-64) shaped to look like an ordinary physical key. cryptovariable - NSA calls the output of a stream cipher a key or key stream. It often uses the term cryptovariable for the bits that control the stream cipher, what the public cryptographic community calls a key. data encryption key (DEK) used to encrypt the underlying data. derived key - keys computed by applying a predetermined hash algorithm or key derivation function to a password or, better, a passphrase. DRM key - A key used in Digital Rights Management to protect media electronic key - (NSA) key that is distributed in electronic (as opposed to paper) form. See EKMS. ephemeral key - A key that only exists within the lifetime of a communication session. expired key - Key that was issued for a use in a limited time frame (cryptoperiod in NSA parlance) which has passed and, hence, the key is no longer valid. FIREFLY key - (NSA) keys used in an NSA system based on public key cryptography. Key derivation function (KDF) - function used to derive a key from a secret value, e.g. to derive KEK from Diffie-Hellman key exchange. key encryption key (KEK) - key used to protect MEK keys (or DEK/TEK if MEK is not used). key production key (KPK) -Key used to initialize a keystream generator for the production of other electronically generated keys. key fill - (NSA) loading keys into a