3 ms·
I think this was copied from Latacora’s cryptographic right answers without some of the necessary context. It’s specifically talking about the KMS offerings fro
by opheliate 3y ago
I think this was copied from Latacora’s cryptographic right answers without some of the necessary context. It’s specifically talking about the KMS offerings from AWS/Google Cloud, which provide trusted hardware implementations of not just key management, but also symmetric/asymmetric encryption, HMAC, etc. All the symmetric constructions provided by these platforms are AEADs, so the point is, if you’re using AWS’s KMS, don’t think about it, just use the default. Which is fairly sensible advice.
- dikei 3y agoKMS is often used to store KEKs only, you'd still have to create and manage DEKs and use AEAD for actual data encryption.
- dogma1138 3y agoDepends these days KMS also extends to solutions that provide full on encryption as a service such as Vault. If your design allows for a trusted and well vetted EAAS solution to be used that should be the first you go for.
- sneak 3y agoIt also goes on to say not to use Amazon or Google in the last section. Fortunately there are good FOSS KMSes out there. I like Cloudflare's Red October: https://github.com/cloudflare/redoctober https://github.com/cloudflare/redoctober