1

I've been trying to use KMS to store sensitive personal data. We generated a CMK and are using the API/Encrypt over https. The idea was to store login information (emails) using KMS, we are using a password less authentication (JWT). This email data could potentially be decoded if some feature requires it but that's not the issue here.

I know that encrypting the same input using envelope encryption will give me a different result every time thus why encrypted keys need to be stored alongside the encrypted result, but i want to do one way-comparison to enable secure logins.

I need KMS to use the same key (therefore not envelope encryption right?) for every encrypt call so i can compare encrypted results. Is this something that can be done using KMS? Do i need to manually generate a key and securely store it in CMK to allow this or can i use a KMS-generated key? I've read all the KMS documentations but it's still a bit fuzzy and i can't find a decent source clearly explaining all this. My PoC clearly returns a different result every time.

I sincerely hope i'm asking the question in the right place, i dont think it's well suited for SO. Thanks!

Improve this question
1
  • After much reading and investigations i have concluded that this is not possible using KMS but please correct me if I'm wrong. Therefore we will have to store a SHA-256 hash for login comparisons alongside the KMS encrypted values. Really wish it could have been avoided..
    – Narcil
    Apr 12, 2017 at 13:31

1 Answer 1

Reset to default
1

KMS uses envelope encryption. The encryption key changes each time you make a request for a key.

If you need a key that doesn't vary you'll need to manage your own encryption.

Improve this answer
1
  • Thanks. We will do SHA-256 hashing for one-way comparisons.
    – Narcil
    Apr 14, 2017 at 18:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .