This disclosure is directed to content protection key management. In general, devices may include secure processing resources configured to derive content keys (e.g., for use in decrypting secure content) using key ladders. In one embodiment, a device may comprise, for example, at least a secure processing module to derive content keys for use in decrypting secure content. The secure processing module may include, for example, a key ladder storage module and a secure key storage module. The key ladder storage module may be to store at least one key ladder for use in deriving at least one content key. The secure key storage module may be to store the at least one content key derived using the key ladder.