I'm working on a project where we need to encrypt a large number of files and store them on the cloud. And I'm wondering if the following process would be secure (we have a “Hardware Security Module” and an “encryption server” in a private data center, only the files will be in the cloud).
Since the volume of the files is too big to be encrypted in an HSM, my idea is to:
- Have a 256 bit master encryption key in an HSM.
- Derive an encryption key by generating a 256 bit random number and HMAC-SHA2-256 it with the master encryption key.
- Take the rightmost 128 bits from the MAC and use that as an AES key.
- Take the leftmost 128 bits from the MAC and use them as the IV.
- Encrypt the content in an internal server.
- Overwrite the memory where the derived AES key was stored.
- Store some metadata of the file (including the 256bits random number from the 2nd step).
I would do something similar to generate a signing key:
- Have 256bit master signing key in an HSM.
- Derive a signing key by generating a 256 bit random number and HMAC-SHA2-256 it with the master signing key.
- MAC the encrypted file with the derived signing key
- Overwrite the memory where the derived signing key was stored.
- Store some metadata of the file (including the 256bits random number from the 2nd step).
To decrypt the data, I would use the random number to re-derive the key. What I'm trying to achieve with this is a different key per file, plus we can rotate the master key every now and then for extra security. Plus, after a few years, when we don't need those files, we can delete the master key (apart from deleting the files from the cloud).
I know the process above is not 100% secure, as the derived key will exist outside the HSM, but we need to keep a balance between security and cost. If storing the plain random numbers is not secure, I could have an AES key in the hsm only to encrypt the random numbers.
The level of security / assumptions I'm happy to live with is:
- If the HSM is compromised, all files are compromised (this quite an obvious one)
- If the encryption server is compromised, an attacker has access to the plain text files before they are encrypted (so I don't even bother to think about the attacker stealing the AES keys as they are in memory).
- An attacker stealing the database (with the random numbers) plus all the files, cannot decrypt the data.
(I hope these assumptions are sensible - please let me know if you disagree!)