3 ms·

I assume Microsoft itself has access to the keys in the Key Vault?

lstamour 12y ago
Sure, you can make that assumption. Even with an HSM protecting things, they still own and manage the HSM, not you. But then the same can be said for everything else you run in Microsoft's cloud or any other service provider, really. Once I read that the NSA would sometimes take computers from transport and modify them, I realized the NSA is the type of persistent threat you simply can't avoid. It can't be helped in this day and age. For more on the HSM service and how it works: http://blogs.technet.com/b/kv/ http://blogs.technet.com/b/kv/
- smacktoward 12y ago
  Can't be helped technically. The way you solve problems like this is with strong laws and vigorous enforcement, not more/different/better tech.
  - mc808 12y ago
    That's completely backwards when people break the laws with impunity and/or the threat to security is law enforcement and the rest of the legal system. At best, laws are a temporary stop-gap measure until the technology is capable and verifiable.
- higherpurpose 12y ago
  Why can't the keys be managed in an end-to-end fashion? Wasn't it Cloudflare announcing something like that a few months ago, with clients having their own key-servers that Cloudflare itself can't access?
  - lstamour 12y ago
    They can be, but this avoids the round-trip time entirely. Microsoft's not forcing you to keep your secrets in the cloud if you don't want to, what they're saying is, "you don't have to run it all yourself if you don't want to" or for those already in the cloud, "it's more secure (or audit-able, at least) to store and share secrets using an HSM than to use plain-text on a hard drive". Of course, nothing's perfect, and even your secrets will eventually end up in RAM, but that's why they call it "defense-in-depth" right? Plus, it means if you're encrypting something, you can use the HSM to do it and know that only the HSM box has the keys to what you're encrypting, and it's dedicated and designed for that task. I personally like HSMs as a concept and look forward to lower cost options as we rely more on encryption in the cloud.
    - higherpurpose 12y ago
      I realize the "it's easier" part. That's why most of us use email over TLS/STARTTLS instead of PGP. However, I don't think Microsoft is going to address the "trust" issue foreign governments and companies have with American clouds right now. Granted, I'm only picking on Microsoft because they are announcing this now, and I think they could've done better. But I assume Amazon and Google's encryption also relies on "trusting them" (+ the US gov). They all need to adopt more end-to-end solutions from end-user services to enterprise cloud services. Perhaps especially for enterprise cloud services, since I think they have more to lose by putting their trust in the cloud providers instead of building their own clouds, and they could be more reluctant to adopt their services because of that. Maybe the cloud companies aren't feeling this as much now since there seems to be "growth" coming in anyway, but when the market will stabilize a bit, they will probably start feeling it. It's kind of how Blackberry didn't feel the they are banking on a bad strategy in the post-iPhone years, because they were still seeing "growth" during that time, mostly from other markets, hiding the fact they were using a bad strategy, and they were only growing because of brand inertia from previous years.
    - anonymousDan 12y ago
      "and even your secrets will eventually end up in RAM" Maybe not necessarily in future: https://www.usenix.org/conference/osdi14/technical-sessions/presentation/baumann https://www.usenix.org/conference/osdi14/technical-sessions/...
  - pfg 12y ago
    I suppose nothing on Azure would stop you from connecting your Azure instances to your own HSM outside of their DCs (although that would make maintenance your problem instead of Microsoft's). Granted, that solution wouldn't be as nicely integrated with their other services. I guess from a business POV, making it easier to be compliant with various security standards that require practices like encrypt-at-rest > building a solution that's secure even against state actors.
    - Spooky23 12y ago
      Why wouldn't it? Very few businesses really have this requirement. End of the day, if the Feds show up with a warrant or warrant-like paper, I'm not going to jail for my employer. Hell, if I was locked up defending their data, I'd probably be expected to charge my accruals for my absence.

Sure, you can make that assumption. Even with an HSM protecting things, they still own and manage the HSM, not you. But then the same can be said for everything else you run in Microsoft's cloud or any other service provider, really. Once I read that the NSA would sometimes take computers from transport and modify them, I realized the NSA is the type of persistent threat you simply can't avoid. It can't be helped in this day and age. For more on the HSM service and how it works: http://blogs.technet.com/b/kv/ http://blogs.technet.com/b/kv/

smacktoward 12y ago
Can't be helped technically. The way you solve problems like this is with strong laws and vigorous enforcement, not more/different/better tech.
- mc808 12y ago
  That's completely backwards when people break the laws with impunity and/or the threat to security is law enforcement and the rest of the legal system. At best, laws are a temporary stop-gap measure until the technology is capable and verifiable.
higherpurpose 12y ago
Why can't the keys be managed in an end-to-end fashion? Wasn't it Cloudflare announcing something like that a few months ago, with clients having their own key-servers that Cloudflare itself can't access?
- lstamour 12y ago
  They can be, but this avoids the round-trip time entirely. Microsoft's not forcing you to keep your secrets in the cloud if you don't want to, what they're saying is, "you don't have to run it all yourself if you don't want to" or for those already in the cloud, "it's more secure (or audit-able, at least) to store and share secrets using an HSM than to use plain-text on a hard drive". Of course, nothing's perfect, and even your secrets will eventually end up in RAM, but that's why they call it "defense-in-depth" right? Plus, it means if you're encrypting something, you can use the HSM to do it and know that only the HSM box has the keys to what you're encrypting, and it's dedicated and designed for that task. I personally like HSMs as a concept and look forward to lower cost options as we rely more on encryption in the cloud.
  - higherpurpose 12y ago
    I realize the "it's easier" part. That's why most of us use email over TLS/STARTTLS instead of PGP. However, I don't think Microsoft is going to address the "trust" issue foreign governments and companies have with American clouds right now. Granted, I'm only picking on Microsoft because they are announcing this now, and I think they could've done better. But I assume Amazon and Google's encryption also relies on "trusting them" (+ the US gov). They all need to adopt more end-to-end solutions from end-user services to enterprise cloud services. Perhaps especially for enterprise cloud services, since I think they have more to lose by putting their trust in the cloud providers instead of building their own clouds, and they could be more reluctant to adopt their services because of that. Maybe the cloud companies aren't feeling this as much now since there seems to be "growth" coming in anyway, but when the market will stabilize a bit, they will probably start feeling it. It's kind of how Blackberry didn't feel the they are banking on a bad strategy in the post-iPhone years, because they were still seeing "growth" during that time, mostly from other markets, hiding the fact they were using a bad strategy, and they were only growing because of brand inertia from previous years.
  - anonymousDan 12y ago
    "and even your secrets will eventually end up in RAM" Maybe not necessarily in future: https://www.usenix.org/conference/osdi14/technical-sessions/presentation/baumann https://www.usenix.org/conference/osdi14/technical-sessions/...
- pfg 12y ago
  I suppose nothing on Azure would stop you from connecting your Azure instances to your own HSM outside of their DCs (although that would make maintenance your problem instead of Microsoft's). Granted, that solution wouldn't be as nicely integrated with their other services. I guess from a business POV, making it easier to be compliant with various security standards that require practices like encrypt-at-rest > building a solution that's secure even against state actors.
  - Spooky23 12y ago
    Why wouldn't it? Very few businesses really have this requirement. End of the day, if the Feds show up with a warrant or warrant-like paper, I'm not going to jail for my employer. Hell, if I was locked up defending their data, I'd probably be expected to charge my accruals for my absence.