Simplified Question
Does it make sense from a security / cryptographic standpoint to encrypt a text in the following way:
- create only one AES key
K_Azure
- create new random key
K_Text1
- encrypt
Text1
withK_Text1
- encrypt
K_Text1
withK_Azure
- store
[ E(K_Text1), E(Text1) ]
in the same storage - store
K_Auzre
somewhere else
Context
The DataProtection in asp.net core provides a mechanism to encrypt and decrypt some data.
The keys are stored in a key-value-pair format of (KeyId, XML), where XML provides some metadata and the actual encryption key itself.
The part of the XML where the key is stored can be encrypted using various providers, my question is about the ProtectKeysWithAzureKeyVault
(link) implemented here.
Protecting the keys
With ProtectKeysWithAzureKeyVault
a data encyption key (let's call it TEXT
, because in our case this will be just a text) is encrypted using a random new generated key (let's call it K_Text
). K_Text
will be encrypted using a single key in the AzureKeyVault (let's call it K_Azure
).
The encrypted TEXT
and encrypted K_Text
are saved in the same store (in the same XML which is saved in in a SQL or file or we...).
To summarize
+------------------------------------ --------+ +---------+
| Database | | Azure |
| ----------------------------------- --------| | --------|
| Id1, E(K_Azure, K_Text1), E(K_Text1, TEXT1) | | K_Azure |
| Id2, E(K_Azure, K_Text2), E(K_Text2, TEXT2) | + --------+
+ ------------------------------------ -------+
E (KEY, TEXT) = encript TEXT with KEY
My question
Is there any reason why it does not encrypt the TEXT
directly with K_Auzre
?
Notes
- AES is used to encrypt everything as far as I know in this context
Update
I think Elias is right, K_Azure is kept in separate hardware and you can not get it.