techlist.io
KREN
microsoft

Common annotated security keys (opens in new tab)

cybersecuritysecret-scanninggithub-advanced-securityazure-devopscasksecurity-tokenstoken-formatentropy

GitHub’s improved security-token format demonstrated that fixed signatures and checksums can sharply reduce both false positives and missed secret detections. Microsoft applies these ideas across its services and proposes the open-source Common Annotated Security Standard (CASK), a shared format for identifiable secrets. CASK is intended to make scanning faster, more accurate, and easier to apply across an entire ecosystem without disrupting developers.

Identifiable Secrets and Better Detection

  • “Identifiable” keys combine:
    • A fixed signature that reliably identifies the format.
    • A checksum that validates whether a detected string is a real key.
  • These features reduce scanner noise and missed findings.
  • Microsoft can hard-block identifiable keys from being stored in source code, work items, and similar locations with high confidence.
  • Scanners can detect the common format first and classify the specific service provider later, if needed.

The Common Annotated Security Standard

  • CASK defines platform-agnostic requirements for minted security keys.
  • It reserves space for individual platforms and providers to encode service-specific metadata.
  • Microsoft has defined Azure-specific metadata within this reserved area.
  • A shared standard lowers the effort required for security tools to protect multiple service providers.
  • Other providers can adopt the same core format.

CASK Key Requirements

Alphanumeric Encoding

  • Keys use only the BASE62 alphabet.
  • Avoiding special characters allows keys to be transmitted without escaping or additional encoding.

Strong Entropy

  • Each key contains 52 randomized encoded characters.
  • This provides approximately 310 bits of entropy.
  • The design is intended to prevent brute-force attacks, including in a post-quantum environment.

Fixed Signatures

  • Every CASK key includes:
    • The standard signature JQQJ.
    • A provider-specific signature.
  • Microsoft observed JQQJ to be rare in both open-source and internal code, enabling fast and accurate detection.
  • Azure DevOps uses AZDO as its provider signature.
  • These signatures allow tools to detect CASK keys generically while still supporting provider-specific classification.

Metadata and Testing Support

  • Keys include their creation month and year.
  • Timestamps support incident response and key-rotation enforcement.
  • CASK reserves dedicated test keys so developers can test scanners and security controls without exposing real credentials.
  • Microsoft plans to provide more details about Azure-specific metadata.

Microsoft recommends that service providers adopt CASK and contribute feedback as the standard evolves.