4 ms·
It’s a bit like saying I don’t have access to keys in my Yubikey. Sure, but I can decrypt data with those keys. If I’m right, S3 sends encrypted data encryptio
by aborsy 4y ago
It’s a bit like saying I don’t have access to keys in my Yubikey. Sure, but I can decrypt data with those keys.
If I’m right, S3 sends encrypted data encryption keys to KMS, and KMS sends back the decrypted data encryption keys. So, although S3 has no access to the master key, it has access to the data keys in RAM for the customer to use. With a “bucket key,” it goes further storing those type of keys in disk.
- colmmacc 4y agoIt's more than what a Yubikey typically does. There are also can't-be-bypassed audit logs of the key usage, and the manner in which S3 is granted access to the data encryption key is very fine-grained; KMS won't allow the S3 systems to decrypt just anything. The key is stored in memory while it's being used to encrypt/decrypt, that's unavoidable, but humans don't have access to that. Bucket keys are a bit different, where there's a per-bucket key which has a similar scheme and then per-object keys are derived from it as needed. Together with random nonces/IVs, it ends up being a bit of a mini multi-party scheme.