0

I'm using Amazon's (AWS) Key Management Service (KMS) to encrypt user data, the KMS uses AES-GCM cryptography.

My problem is that as the AES-GCM key is stored in the KMS and I, as an administrator of my AWS instance, have access to this key and can therefore decrypt user data. My goal is to prevent that.

What can I implement, so that even when I possess the KMS key, I cannot decrypt the user data?

I was thinking that before the user is encrypting data locally with his key stored in KMS, he could encrypt the AES-GCM key with his password that is unknown to AES (and me as the admin). Is that a solution? What algorithms should I use? Thanks!

  • Looks like you want asymmetric encryption. One key for encryption, one for decryption. – Yorick de Wid Sep 8 '16 at 10:29
  • @YorickdeWid could you explain more in a answer? I was thinking of adding a additional security layer by encrypting the AES Key again. But I am not sure if that is secure – John Smith Sep 8 '16 at 10:31
3

Sometimes it's not about being able to prevent access to the keys, as much as it is creating an environment that's able to be audited (i.e., user/admin actions are tracked / reviewed periodically).

The problem you'll run into trying to encrypt, double encrypt, triple encrypt, etc, is that at some point, someone will need the ability to manage (read: decrypt) the data. This could be developers working on the platform, the user needing help with something, data needing to be ported to another application, the list goes on.... The best thing you can do is put a system in place that provides reliable accountability for access to the keys. Sidenote: an HSM doesn't hurt either :)

AWS CloudHSM provides you with a dedicated hardware device installed in your Amazon Virtual Private Cloud (VPC) that provides a FIPS 140-2 Level 2 validated single-tenant HSM to store and use your keys. You have total control over your keys and the application software that uses them with CloudHSM.

Bottom Line

Using KMS or other managed services has the benefit of great auditing / tracking -for visibility into who accessed keys (and when), as well as being able to rotate them on a periodic basis.

Other KMS FAQs

1

You can use the KMS IAM policies to limit specific AWS users or instances from encrypting or decrypting data with a specific KMS customer master key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.