This guide describes basic concepts in Key Management Service (KMS).
Key lifecycle
Key lifecycle refers to a set of operations including generating, saving, distributing, importing, exporting, applying, restoring, archiving and terminating keys. KMS provides a full lifecycle management to manage keys in a safe manner and prevent key leaks.
Symmetric encryption and decryption
Symmetric encryption and decryption is a data encryption technique where the same key is used to both encrypt and decrypt the data.
Note
Key Management Service (KMS) offers symmetric encryption and decryption solutions. For more details, see Symmetric Encryption and Decryption.
Asymmetric encryption and decryption
Asymmetric encryption and decryption requires two keys: a public key and a private key. The public and private keys are a pair, where the sender uses the public key to encrypt data, and the recipient can only decrypt it using the corresponding private key. On the other hand, the sender can sign confidential information using the private key, and the recipient can verify the received data using the corresponding public key.
Note
KMS also supports asymmetric encryption and decryption. For more details, see Asymmetric Encryption and Decryption.
Customer Master Key (CMK)
Customer Master Keys (CMKs) are used to protect sensitive data and Data Encryption Keys (DEKs) of Key Management Service (KMS) users. They are generated by hardware security modules and protected by Domain Keys. CMKs can only be encrypted and decrypted through encryption devices.
Data Encryption Key (DEK)
In envelope encryption scenarios, DEK is used to directly encrypt and decrypt user data. It is generated by the key management system using a hardware security module (HSM) and returned to the application system in both ciphertext and plaintext forms after being encrypted by the customer master key (CMK). The business side performs high-performance local encryption and decryption using the plaintext DEK in memory.
White-box Key
White-box keys are secured using white-box cryptography techniques and are designed to protect sensitive root key information on the client side, such as API SecretKey, authentication keys or tokens used by internal systems, and other local sensitive root key information.
Note
Key Management Service (KMS) offers a solution for white-box key management. For more details, see White-box Key Management.
Sensitive data
Sensitive data refers to sensitive and private information, such as keys, certificates, configuration files, bank account numbers, and identification numbers.
HSM
Hardware Security Module (HSM) is a computer hardware device designed to protect and manage keys used in strong authentication systems while providing cryptographic operations. KMS utilizes commercial or FIPS-140-2 certified HSMs to ensure the confidentiality, integrity, and availability of keys.
BYOK
Bring Your Own Key (BYOK) allows users to import their own key material into their master key. For more information, please refer to External Key Import.