I'm trying to understand the Azure RMS solution. From my understanding, files are encrypted with a symmetric key, and that symmetric key + access policies are encrypted using the company key.

The company key can either be:

  • MMK (generated and managed by Microsoft)
  • BYOK (generated by the company, managed by Microsoft)
  • HYOK (generated and managed by the company)
  • DKE (Double-Key Encryption, a combination of (BYOK or HYOK) with MMK)

I don't understand why DKE would be better than just BYOK/HYOK.

Their main benefits are to :

  1. Keep the data unintelligible to Microsoft
  2. Be able to retrieve the data if something goes wrong (because we know the key)

AFAIK, DKE doesn't have benefit #2 because the data will also be encrypted by MMK.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.