I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options.

Option 1) Storing the key on the same server (not recommended, because an attacker might easily get access to the key if the server is hacked.

Option 2) Storing the key on another server (the attacker needs to get access to both servers). Both servers need to be secured. The key could be transmitted via SSL. This seems to be a quite often used approach.

Option 3) Using KMS like Google and Amazon (Problem: authentication to the server is required, so the key might also be available if the attacker has access to the server). Is there a workaround?

Option 4) Using HSM cloud server (in my opinion the best option relating to security but with high prices)

Are there other ways to secure a key in a good way? My use case: I have a cloud server with a database and would like to encrypt the database content. How can I secure the key so that it is not lost if an attacker has access to the webserver.

  • In option 3, a competently implemented KMS will only give clients access to decrypt or sign data using the key, not to actually retrieve the key itself. So an attacker who breaches your security won’t be able to access the key, only to use it for decryption or signing for the duration of the breach.
    – Mike Scott
    Commented Feb 4, 2022 at 9:26
  • Option 5) Hardware HSM. There are a couple options, they plug on an USB port, with varying price tags and features.
    – ThoriumBR
    Commented Feb 4, 2022 at 11:50


You must log in to answer this question.

Browse other questions tagged .