|
Cryptographic key management involves storing and managing encryption decryption keys , certificates , signatures etc . If the requirement is just to store and manage object specific keys ( say amazon's s3 store objects ) do we really require a key management solution like the one from porticor or an appliance ? Instead can't we generate object specific keys "on the fly" using HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time ? |
|||||
|
Sure you can. I've got an even easier method. Just use the same key for everything. No key derivation or key management needed. Or even better, don't encrypt anything. No keys, no management, much simpler. My point is, there are no solutions, only tradeoffs. Your proposal has its benefits, but also has its disadvantages (assuming object ids are public, an attacker need only steal one small piece of information, the master key, and all objects are compromised as pointed out by Ricky). |
|||
|
|
