New answers tagged key-management
4
It is a trade-off between
the security of storage (TPM is better, in theory it won't give off the key to anyone, it will just accept data to encrypt/sign for you with the key),
the security of implementation (openssl is opensource, TPM may have a nasty backdoor) and
the ease of use (a PEM file generated by openssl is universal, a key in TPM needs a TPM ...
23
The difference between using some hardware backed key store (i.e. TPM, HSM, smartcard ...) and a "pure software" solution like openssl genrsa is not so much about the security of the key generation but about the security of the key storage.
HSM and similar are designed to never actually provide the created private key but only do operations like ...
0
Have you considered signed URLs? If your app has authentication you can get the user to authenticate and then have your app create a custom signed S3 URL for the user. This then gets sent back and can be used directly from the application.
For authentication you can use something like AWS cognito. From this they get an auth token that you validate on your ...
-1
imagine scenario of bank locker system where u have one key and bank staff have another key when two put together your locker gets opened here mek is bank staff key and dek is your key.
2
From my point of view you should not have the private key with password on this scenario, because your microservice will need to know the password in some way.
In general and from my experience the private keys of microservices are stored in other backends dedicated to this, for example with LDAP. So your microservice that is authorized to the backend that ...
Top 50 recent answers are included
