1
$\begingroup$

Cryptographic key management involves storing and managing encryption decryption keys , certificates , signatures etc .

If the requirement is just to store and manage object specific keys ( say amazon's s3 store objects ) do we really require a key management solution like the one from porticor or an appliance ? Instead can't we generate object specific keys "on the fly" using HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time ?

$\endgroup$
  • $\begingroup$ The fact that all of the keys can be calculated from the master key and object ids. $\qquad \qquad \qquad$ $\endgroup$ – user991 Nov 9 '12 at 5:27
  • $\begingroup$ @ricky ,did not get you , i edited the question for more clarity . $\endgroup$ – sashank Nov 9 '12 at 6:06
3
$\begingroup$

Instead can't we generate object specific keys "on the fly" using HKDF using a master key and object id as inputs, so that we dont have overhead of storing and managing keys each time?

Sure you can. I've got an even easier method. Just use the same key for everything. No key derivation or key management needed. Or even better, don't encrypt anything. No keys, no management, much simpler.

My point is, there are no solutions, only tradeoffs. Your proposal has its benefits, but also has its disadvantages (assuming object ids are public, an attacker need only steal one small piece of information, the master key, and all objects are compromised as pointed out by Ricky).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.