0

I'm using Amazon's (AWS) Key Management Service (KMS) to encrypt user data, the KMS uses AES-GCM cryptography.

My problem is that as the AES-GCM key is stored in the KMS and I, as an administrator of my AWS instance, have access to this key and can therefore decrypt user data. My goal is to prevent that.

What can I implement, so that even when I possess the KMS key, I cannot decrypt the user data?

I was thinking that before the user is encrypting data locally with his key stored in KMS, he could encrypt the AES-GCM key with his password that is unknown to AES (and me as the admin). Is that a solution? What algorithms should I use? Thanks!

Improve this question
2
  • Looks like you want asymmetric encryption. One key for encryption, one for decryption.
    – Yorick de Wid
    Sep 8, 2016 at 10:29
  • @YorickdeWid could you explain more in a answer? I was thinking of adding a additional security layer by encrypting the AES Key again. But I am not sure if that is secure
    – John Smith
    Sep 8, 2016 at 10:31

2 Answers 2

Reset to default
4

Sometimes it's not about being able to prevent access to the keys, as much as it is creating an environment that's able to be audited (i.e., user/admin actions are tracked / reviewed periodically).

The problem you'll run into trying to encrypt, double encrypt, triple encrypt, etc, is that at some point, someone will need the ability to manage (read: decrypt) the data. This could be developers working on the platform, the user needing help with something, data needing to be ported to another application, the list goes on.... The best thing you can do is put a system in place that provides reliable accountability for access to the keys. Sidenote: an HSM doesn't hurt either :)

AWS CloudHSM provides you with a dedicated hardware device installed in your Amazon Virtual Private Cloud (VPC) that provides a FIPS 140-2 Level 2 validated single-tenant HSM to store and use your keys. You have total control over your keys and the application software that uses them with CloudHSM.

Bottom Line

Using KMS or other managed services has the benefit of great auditing / tracking -for visibility into who accessed keys (and when), as well as being able to rotate them on a periodic basis.

Other KMS FAQs

Improve this answer
1

You can use the KMS IAM policies to limit specific AWS users or instances from encrypting or decrypting data with a specific KMS customer master key.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .