3

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted with user's public key (key wrapping), so imagine 500 encrypted file with 500 encrypted encryption key stored in the server. File and key are stored encrypted and separately in different server and file is already encrypted before sent to the server. Everytime user wants to access the file, he needs to decrypt the encrypted key with his private key then use the key to decrypt the file.

I was thinking if there is an alternative to that, say user is able to generate the key without storing it to the server or using key wrapping. Also this alternative should also work with multiple devices.

My idea is that user can calculate the keys by himself without the need to store the key in the server to avoid unauthorized user listening to the communication during key exchange.

Any idea will help.

Thanks

Improve this question
2
  • 1
    you need to describe what the requirements are and what the specifications are for what you want to secure and why
    – schroeder ♦
    Apr 6, 2016 at 14:43
  • the reason is that i think the current architecture will store a lot of encryption keys depending on each file, for example if user has 300 files then 300 encryption keys will be stored as well, multiply that with number of users in the cloud storage. I want it somehow a simpler way to manage those keys that will work in multiple devices. My idea is that user can calculate the keys by himself without the need to store the key in the server to avoid unauthorized user listening to the communication during key exchange.
    – Ihsan Haikal
    Apr 6, 2016 at 15:38

1 Answer 1

Reset to default
4

If you are supplying the application that stores and retrieves the encrypted files for the user, here are a few ideas you may want to consider...

1) Rather than encrypting data at the cloud storage, consider encrypting the data files prior to storing in the cloud service. You can find numerous options for encryption libraries on GitHub.

2) Store the Keys used for encryption separate from the data. Consider using an encryption-as-a-service offering and making REST API calls to retrieve the Keys when needed.

3) Use a Key vendor who specializes and has the expertise in crypto, authentication, and identity so that you get reliable and robust Keys.

You may want to try out several options before choosing a specific approach. Here's an example EaaS / Key service you can try for free: www.ncryptify.com

Improve this answer
1
  • 1
    The file and key are stored separately in different server and the file is already encrypted before it was sent to the server. What I am trying to find is basically to simplify the key management so that user does not need to retrieve the encrypted key everytime user wants to access the file and the key is not stored in the server.
    – Ihsan Haikal
    Apr 6, 2016 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .