3 ms·
I am a bit confused about the KMS advice. KMS makes sense for encryption of data in cloud, since the companies already have access to data. It’s usually an ad
by aborsy 4y ago
I am a bit confused about the KMS advice.
KMS makes sense for encryption of data in cloud, since the companies already have access to data. It’s usually an additional layer of access control, monitoring and compliance.
But it seems a bad practice to have an external company create and manage cryptographic keys, and/or manage encryption of on-premise or personal data (like encrypting your backups with an AWS KMS key, client side, and uploading to S3).
Apart from that, KMS is a solution for key management. The users can use keys with any algorithm.
Also, I am not sure if AWS encryption SDK is particularly of high quality. Anyone knows?
- mschout 4y agoI also am confused somewhat here. With KMS, if you need to encrypt larger payloads, KMS itself is of no help except to generate a data key to use and you are left to either use AwsCrypto, or roll your own encryption using the data key which itself is encrypted by AWS KMS. If you happen to be using a language that does not have a port of the AwsCrypto library I am unclear if say AES CBC is okay or not. If you are able to use AwsCrypto with KMS, I am assuming that is the recommended pathway as that is the default that AWS provides and I am hoping that AWS has thought it through enough to have a sensible default.