Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Cryptographic key management involves storing and managing encryption decryption keys , certificates , signatures etc .

If the requirement is just to store and manage object specific keys ( say amazon's s3 store objects ) do we really require a key management solution like the one from porticor or an appliance ? Instead can't we generate object specific keys "on the fly" using HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time ?

share|improve this question
    
The fact that all of the keys can be calculated from the master key and object ids. $\qquad \qquad \qquad$ –  Ricky Demer Nov 9 '12 at 5:27
    
@ricky ,did not get you , i edited the question for more clarity . –  sashank Nov 9 '12 at 6:06
add comment

1 Answer

up vote 3 down vote accepted

Instead can't we generate object specific keys "on the fly" using HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time?

Sure you can. I've got an even easier method. Just use the same key for everything. No key derivation or key management needed. Or even better, don't encrypt anything. No keys, no management, much simpler.

My point is, there are no solutions, only tradeoffs. Your proposal has its benefits, but also has its disadvantages (assuming object ids are public, an attacker need only steal one small piece of information, the master key, and all objects are compromised as pointed out by Ricky).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.