I've been trying to use KMS to store sensitive personal data. We generated a CMK and are using the API/Encrypt over https. The idea was to store login information (emails) using KMS, we are using a password less authentication (JWT). This email data could potentially be decoded if some feature requires it but that's not the issue here.

I know that encrypting the same input using envelope encryption will give me a different result every time thus why encrypted keys need to be stored alongside the encrypted result, but i want to do one way-comparison to enable secure logins.

I need KMS to use the same key (therefore not envelope encryption right?) for every encrypt call so i can compare encrypted results. Is this something that can be done using KMS? Do i need to manually generate a key and securely store it in CMK to allow this or can i use a KMS-generated key? I've read all the KMS documentations but it's still a bit fuzzy and i can't find a decent source clearly explaining all this. My PoC clearly returns a different result every time.

I sincerely hope i'm asking the question in the right place, i dont think it's well suited for SO. Thanks!

  • After much reading and investigations i have concluded that this is not possible using KMS but please correct me if I'm wrong. Therefore we will have to store a SHA-256 hash for login comparisons alongside the KMS encrypted values. Really wish it could have been avoided..
    – Narcil
    Apr 12, 2017 at 13:31

1 Answer 1


KMS uses envelope encryption. The encryption key changes each time you make a request for a key.

If you need a key that doesn't vary you'll need to manage your own encryption.

  • Thanks. We will do SHA-256 hashing for one-way comparisons.
    – Narcil
    Apr 14, 2017 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.