3

Let's consider two Encryption keys:

1.Data-Encryption-Key(DEK)

2.Key-Encryption-Key(KEK)

KEK will be securely stored in HSM, which will be encrypted using master key. Data Encryption Key will be decrypted using KEK.

Based on the above concept, my doubts are:

Do we need to send the Encrypted DEK to the HSM for decrypting it or Do we need to decrypt the KEK and retrieve it from HSM ?

I just want to know the key encryption and decryption process flow, while using HSM.

Also provide any helpful links.

Improve this question
1
  • 1
    Usually the HSM does all the crypto without the KEK ever leaving the device - you feed it an encrypted DEK and it gives you an unencrypted DEK back.
    – Polynomial
    Jan 23, 2014 at 10:01

1 Answer 1

Reset to default
4

If the encryption/decryption of the data is taking place on the HSM, the KEK will decrypt the DEK for performing encryption/decryption operations. All key management, key storage and crypto takes place within the HSM.

If the encryption/decryption of the data is taking place in the application, you could interface with the HSM to extract the DEK and do your crypto at the application. All key management and storage would remain within the HSM though cryptographic operations would be handled on the application server.

If the encryption/decryption of the data is taking place in the application and the application holds the DEK secured with the KEK, you may retrieve the KEK from the HSM, decrypt the DEK and do your crypto. All key management and storage is handled between the HSM and the application and cryptographic operations would be handled on the application server.

You can use the HSM however best suits your requirements.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .