Cryptographickeys for encrypted data stored in the cloudshould be .

A fundamental principle of cloud data security is maintaining control over encryption keys. Storing cryptographic keys separately from the cloud provider where the encrypted data resides enforces separation of duties and prevents the provider from having unilateral access to the data. This model, often implemented via a customer-managed key (CMK) solution or an on-premises Hardware Security Module (HSM), ensures that the data owner retains ultimate control over data confidentiality. If the provider holds both the lock (encryption) and the key, the security of the data is entirely dependent on the provider's internal controls.

B. Generated with redundancy: Key availability is important, but storing keys separately from the data is a more critical control principle in a cloud context.

C. At least 128 bits long: This is a minimum standard for strength, but control over the key (location) is arguably more important than strength alone.

D. Split into groups: This is an advanced technique (secret sharing) not universally required for all cloud data encryption; it adds significant complexity.

1. Cloud Security Alliance (CSA). "Security Guidance for Critical Areas of Focus in Cloud Computing v4.0" (2017). Domain 10, "Identity, Entitlement, and Access Management," Section 10.5.2 states, "The enterprise should generate and manage its own keys... Keys should not be stored in the same location as the data they are protecting."

2. NIST SP 800-57 Part 1 Rev. 5, "Recommendation for Key Management: Part 1 – General" (May 2020). Section 5.2, "Key Management Principles," discusses the principle of separating key management from data storage to enforce security policies.

3. NIST SP 800-144, "Guidelines on Security and Privacy in Public Cloud Computing" (December 2011). Section 6.3, "Data Protection," notes the importance of key management, where the consumer's ability to control keys is a key consideration.