I'm trying to understand the Azure RMS solution. From my understanding, files are encrypted with a symmetric key, and that symmetric key + access policies are encrypted using the company key.
The company key can either be:
- MMK (generated and managed by Microsoft)
- BYOK (generated by the company, managed by Microsoft)
- HYOK (generated and managed by the company)
- DKE (Double-Key Encryption, a combination of (BYOK or HYOK) with MMK)
I don't understand why DKE would be better than just BYOK/HYOK.
Their main benefits are to :
- Keep the data unintelligible to Microsoft
- Be able to retrieve the data if something goes wrong (because we know the key)
AFAIK, DKE doesn't have benefit #2 because the data will also be encrypted by MMK.