Cloud based Key Management Services

By Louis Chu

Agenda

• Cryptography concepts
• AWS encryption SDK
• AWS KMS
• Google Cloud KMS
• Azure key vault

​

Cryptography concepts

• Hash
• Symmetric VS Asymmetric
• Encryption of data at rest
• Symmetric Mode
• AES-GCM
• Key Derivation Functions

​

​

​

​

Key Management

• Key rotation
• Harder to obtain the key
• Track and log key usage
• And more!

Envelope encryption

AWS Encryption SDK

• Open sourced
• Security best practice
• Support Envelope encryption
• Support KMS integration
• https://github.com/aws/aws-encryption-sdk-javascript/tree/master/modules/example-node/src

​

• Concepts
• Keyring
• Modules
• Encrypt
• Decrypt
• Hkdf
• Material management
• Material cache
• …

KMS Key hierarchy

AWS KMS key policy

AWS KMS auditing & Amazon S3 data trail

AWS KMS Use case – Kinesis Streams records

AWS KMS other features

• Digital Signature
• Asymmetric encryption
• Multi-Region key

Azure Key Vault Overview

• Centralization and protection
• Application secrets
• Encryption Keys
• Certificates
• Vault backed by HSM (Hardware Security Modules)
• HSM Pools

Azure Key Vault – Application Secrets

Azure Key Vault Concepts

• Tenant
• Security Principal
• Resource
• Resource Group
• Azure Active Directory
• Managed Identities
• Rest API reference: https://learn.microsoft.com/en-us/rest/api/keyvault/

​

Azure Key Value Panel

Google Cloud KMS Overview

• Centrally manage encryption keys
• Deliver hardware key security with HSM
• Provide support for external keys with EKM

Comparison

Ref

• https://aws.amazon.com/blogs/big-data/encrypt-and-decrypt-amazon-kinesis-records-using-aws-kms/
• https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#envelope-encryption
• https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html
• https://csrc.nist.gov/publications/detail/sp/800-38d/final
• https://www.youtube.com/watch?v=hxWvbNvj2lg
• https://www.youtube.com/watch?v=PgujSug1ZbI
• https://cloud.google.com/security-key-management
• https://www.g2.com/compare/aws-key-management-service-kms-vs-google-cloud-platform-security-overview-vs-azure-key-vault

​

​

​

​