4
The whole point of AWS Secret Manager and KMS is to store secrets and keys, so I don't see why this would not be safe. However, the actual security of your implementation is likely to be dependent on how you use those services, and whether or not your code integrates those services safely.
Since your platform handles financial transactions, and I presume ...
4
NIST thinks you should.
NIST SP800-57 Part 1 "Recommendation for Key Management (Part 1 - General)" lays out definitions and recommendations for encryption keys and their management. Under ยง5.3.6 Cryptoperiod Recommendations for Specific Key Types it covers DEKs:
Symmetric data-encryption key:
a. Type Considerations: A symmetric data-encryption ...
3
It depends entirely on your threat model.
Ultimately, your DEK is the critical one - if someone has your data and your DEK then it is game over. Moreover, if someone has access to your data and the DEK then rotating all the other keys won't matter.
Still, only you can decide whether or not it is worth the effort to rotate the DEK. Hence the question: what is ...
3
The user password is pre-hashed with a slow password hashing function on the client side, twice, using different algorithms and/or salts. One hash is used to generate a login token (used like a password) which is sent to the server (where it gets additional hashing, and possibly also requires stuff like MFA). The other one is used as a "password-derived ...
3
For people looking at this question now - this may be a better (updated) answer:
https://webauthn.guide/
From the site:
The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using ...
1
First, you should have a clear threat model and a rationale for your choices: Why are you using a three layers of encryption keys? Why not two, or twenty? Why do you rotate the keys? How are you expecting the data to be stored?
And second, rotating the DEK doesn't neccessarily require re-encrypting many blocks of data (immediately).
Option A would be to ...
Only top voted, non community-wiki answers of a minimum length are eligible
