# Understand Key Concepts in Tink

When you start working with Tink for the first time, there are some key concepts
you should understand before you begin your journey; these are described in the
following sections.

## Primitives

Tink uses *primitives* as cryptographic building blocks that manage an
underlying algorithm so users can perform cryptographic tasks safely. A
primitive defines the details of a cryptographic algorithm and the key type.

- See [Choose a primitive](https://developers.google.com/tink/choose-primitive) for an overview of supported primitives and their use cases.
- See [Supported primitives by language](https://developers.google.com/tink/primitives-by-language) for
  compatibility information.

- See [Primitive design](https://developers.google.com/tink/design/primitives_and_interfaces) for detailed
  background information.

## Key types

A *key type* implements a specific primitive. Most primitives have several key
types to choose from depending on your requirements for security, runtime, and
space. For example, AES128_GCM is an [AEAD](https://developers.google.com/tink/aead) that is fast and
effective for most needs. See more at [Supported key types by
language](https://developers.google.com/tink/supported-key-types).

## Keysets \& keyset handles

Tink uses *keysets* for managing keys. A keyset is essentially a set of keys
that facilitate key rotation. Noteworthy properties of a keyset are:

- Each key in a keyset has a unique ID, which is unique within a keyset. This ID is usually added as a prefix to each produced ciphertext, signature or tag to indicate which key was used (see how Tink [tags
  ciphertexts](https://developers.google.com/tink/design/keysets#tagging_ciphertexts) for more info).
- Only one key at a time in a keyset is *primary*. A primary key in a keyset is the key "in use" at the moment.
- All the keys in a keyset *must* be implementations of the same primitive (such as AEAD), but can have different key types (for example, an AES-GCM and XCHACHA20-POLY1305 key).

Each Tink implementation provides APIs to create or edit keysets. However, we
recommend using [Tinkey](https://developers.google.com/tink/tinkey-overview) our CLI tool.

Users operate over a keyset using *keyset handles* . A keyset handle limits the
exposure of the actual sensitive key material. It also abstracts a keyset
allowing users to obtain a primitive that "wraps" the entire keyset. For
example, you can get an AEAD primitive of a keyset with `N` keys; encryption and
decryption with the obtained primitive then uses the primary key in the keyset.

For more info, see [keyset design](https://developers.google.com/tink/design/keysets).