---
title: Keys and secrets
description: IG uses cryptographic keys for encryption, signing, and securing network connections, and passwords. The following sections describe how to secure keys and secrets in your deployment.
component: pinggateway
version: 7.2
page_id: pinggateway:security-guide:keys
canonical_url: https://docs.pingidentity.com/pinggateway/2026/security-guide/keys.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2022-04-25T11:07:10Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/security-guide/keys.html
section_ids:
  update-cryptography: Update cryptography
  use-strong-keys: Use strong keys
  rotate-keys: Rotate keys
---

# Keys and secrets

IG uses cryptographic keys for encryption, signing, and securing network connections, and passwords. The following sections describe how to secure keys and secrets in your deployment.

## Update cryptography

Different algorithms and methods are discovered and tested over time, and communities of experts decide which are the most secure for different uses. Use up-to-date cryptographic methods and algorithms to generate keys.

## Use strong keys

Small keys are easily compromised. Use at least the HTTPS://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility\_.28recommended.29\[ recommended key size].

In JVM, the default ephemeral Diffie-Hellman (DH) key size is 1024 bits. To support stronger ephemeral DH keys, and protect against weak keys, consider setting the following system property to increase the DH key size: `jdk.tls.ephemeralDHKeySize=2048`. From Tomcat 8.5.37, the default DH key size is 2048-bit.

For more information, see [Customizing size of ephemeral Diffie-Hellman keys](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#customizing_dh_keys)

## Rotate keys

Rotate keys regularly to:

* Limit the amount of data protected by a single key.

* Reduce dependence on specific keys, making it easier to migrate to stronger algorithms.

* Prepare for when a key is compromised. The first time you try key rotation shouldn't be during a real-time recovery.

* Conform to internal business compliance requirements.

For more information, see [Rotating keys](../maintenance-guide/rotate-keys.html).