Best practices for deploying KMSes
All major public cloud providers have implementations of a managed KMS – a secured location (or a vault) for generating, storing, and retrieving encryption keys.
The following are some important concepts in the key management field:
- Key Encryption Key (KEK): This is used for generating other encryption keys. The KEK is stored inside the KMS and never leaves it since it wraps (encrypts) other keys in the hierarchy below it.
- Data Encryption Key (DEK): This is used for encrypting the data itself. The DEK is stored near the data itself. KMSes keep a history of DEKs and keep this information in metadata near the data itself, which allows the encrypted service to know which DEK version to use.
- Master Encryption Key (MEK): This is used for encrypting and decrypting the DEK in transit.
- Key Generation: The idea of regenerating new encryption keys to avoid the potential of the key being revealed by an external third party due to...
