You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: pages/key-manager/concepts.mdx
+48-8Lines changed: 48 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,12 @@ The public key is used for encryption and can be shared openly, while the privat
14
14
15
15
Asymmetric encryption is particularly well-suited for secure communication and authentication, such as encrypting emails or verifying digital signatures. However, it is slower than symmetric encryption. Algorithms like RSA and ECC are common examples of asymmetric encryption.
16
16
17
+
As of now, Key Manager supports the following asymmetric encryption algorithms:
18
+
19
+
- RSA-OAEP-2048-SHA256: RSA encryption with 2048-bit key and OAEP padding using SHA-256.
20
+
- RSA-OAEP-3072-SHA256: RSA encryption with 3072-bit key and OAEP padding using SHA-256. (recommended)
21
+
- RSA-OAEP-4096-SHA256: RSA encryption with 4096-bit key and OAEP padding using SHA-256.
22
+
17
23
## Ciphertext
18
24
19
25
Ciphertext refers to data that has been encrypted using a cryptographic algorithm and a key.
@@ -27,11 +33,13 @@ Ciphertext can be encrypted on the client side as long as the encryption key use
27
33
28
34
A cryptographic operation is any action performed using cryptography to secure data, ensure privacy, or authenticate information.
29
35
30
-
Key Manager supports the three following cryptographic operations:
36
+
Key Manager supports the five following cryptographic operations:
These operations are designed to protect data from unauthorized access, ensure its integrity, and verify the identities of users or systems.
37
45
@@ -53,7 +61,7 @@ The only way to decrypt an encrypted payload is by using the `Decrypt` [endpoint
53
61
54
62
A cryptographic operation used to encrypt data using the latest version of the Key Manager key. The [encryption algorithm](#encryption-algorithm) used is the one defined when setting the [key usage](#key-usage).
55
63
56
-
Only keys with a usage set to `symmetric_encryption` are supported by this method. The input data is arbitrary, but this endpoint should only be used to encrypt **data encryption keys**, not actual [payloads](#payload).
64
+
The input data is arbitrary, but this endpoint should only be used to encrypt **data encryption keys**, not actual [payloads](#payload).
57
65
58
66
[Find out how to encrypt and decrypt payloads using The Scaleway Tink provider](/key-manager/api-cli/manage-keys-with-tink)
59
67
@@ -63,21 +71,27 @@ An encryption algorithm is the specific procedure used to perform encryption and
63
71
64
72
It defines the exact steps to transform plaintext into ciphertext and vice versa using a key.
65
73
66
-
As of now, Key Manager supports the following encryption algorithm:
74
+
As of now, Key Manager supports the following **symmetric**encryption algorithm:
67
75
68
76
- AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm.
69
77
78
+
It also supports the following **asymmetric** encryption algorithms:
79
+
80
+
- RSA-OAEP-2048-SHA256: RSA encryption with 2048-bit key and OAEP padding using SHA-256.
81
+
- RSA-OAEP-3072-SHA256: RSA encryption with 3072-bit key and OAEP padding using SHA-256. (recommended)
82
+
- RSA-OAEP-4096-SHA256: RSA encryption with 4096-bit key and OAEP padding using SHA-256.
83
+
70
84
## Encryption method
71
85
72
86
An encryption method is a broader approach used to convert readable data ([plaintext](#plaintext)) into an unreadable format ([ciphertext](#ciphertext)) which may involve one or more [encryption algorithms](#encryption-algorithm).
73
87
74
88
There are three types of encryption methods:
75
89
76
90
-[Symmetric encryption](#symmetric-encryption)
77
-
-[Asymmetric encrytpion](#asymmetric-encryption)
91
+
-[Asymmetric encryption](#asymmetric-encryption)
78
92
- Hybrid encryption: An encryption method that combines both symmetric and asymmetric methods
79
93
80
-
Key Manager only supports symmetric encryption.
94
+
Key Manager supports symmetric and asymmetric encryption.
81
95
82
96
## Encryption scheme
83
97
@@ -112,14 +126,16 @@ When using [symmetric encryption](#symmetric-encryption), it is generally recomm
112
126
113
127
After rotating your Key Manager keys, all cryptographic operations will use the new rotated keys. All data encrypted with former key versions will remain decipherable with the former key.
114
128
129
+
Key rotation is only available for symmetric keys.
130
+
115
131
## Key usage
116
132
117
133
The key usage specifies the **algorithm** used to create subsequent key versions, and the **scope of cryptographic operations** supported by your key encryption key.
118
-
You must define a key usage upon key creation. As of now, Key Manager **only supports symmetric encryption**.
134
+
You must define a key usage upon key creation. Key Manager supports symmetric encryption, asymmetric encryption and asymmetric signing.
119
135
120
136
## Key version
121
137
122
-
A key version is a a specific iteration of your key encryption key. Each version of your key represents a distinct state or version that may be [rotated](#key-rotation) or replaced over time.
138
+
A key version is a specific iteration of your key encryption key. Each version of your key represents a distinct state or version that may be [rotated](#key-rotation) or replaced over time.
123
139
124
140
Key versions allow you to manage and track changes to your data encryption keys. When using key versions, all cryptographic operations will rely on the current key version.
125
141
@@ -141,16 +157,40 @@ A region refers to the **geographical location** in which your key will be creat
141
157
142
158
A root encryption key (REK) is another type of key that has the single purpose of encrypting and decrypting KEKs in order to store them in hard storage. Scaleway's Key Manager has one REK per region, which is securely stored in our facilities.
143
159
160
+
## Signature
161
+
162
+
Signature is a cryptographic technique used to ensure the authenticity and integrity of data. In this process, a digest (hash) of the message is created and then signed using a private key. This signature can later be verified by anyone with access to the corresponding public key.
163
+
164
+
Signatures are widely used in scenarios like document signing, secure communication, and identity verification. They offer assurance that the data originated from a trusted source and has not been tampered with.
165
+
166
+
As of now, Key Manager supports the following asymmetric signing algorithms:
167
+
168
+
- EC-P256-SHA256: ECDSA signing with the P-256 curve and SHA-256. (recommended)
169
+
- EC-P384-SHA256: ECDSA signing with the P-384 curve and SHA-384.
170
+
- RSA-PSS-2048-SHA256: RSA-PSS signing with 2048-bit key and SHA-256.
171
+
- RSA-PSS-3072-SHA256: RSA-PSS signing with 3072-bit key and SHA-256.
172
+
- RSA-PSS-4096-SHA256: RSA-PSS signing with 4096-bit key and SHA-256.
173
+
- RSA-PKCS1-2048-SHA256: RSA PKCS#1 v1.5 signing with 2048-bit key and SHA-256.
174
+
- RSA-PKCS1-3072-SHA256: RSA PKCS#1 v1.5 signing with 3072-bit key and SHA-256.
175
+
- RSA-PKCS1-4096-SHA256: RSA PKCS#1 v1.5 signing with 4096-bit key and SHA-256.
176
+
177
+
## Signature verification
178
+
179
+
Signature verification is the process of confirming the authenticity and integrity of a digital signature.
180
+
It involves using the public key corresponding to the private key that was used to create the signature to verify that the data has not been altered and that it comes from the claimed sender.
181
+
This process is crucial for ensuring secure and reliable communication.
182
+
144
183
## Scheduled deletion
145
184
146
185
When you delete a key, it is scheduled for deletion. This lets you mark a key and its version for deletion ahead of time. Instead of immediate deletion, the key enters a 7-day pending deletion period, during which you can still recover it.
147
186
148
187
During this time, you can read your key version but cannot edit, access, or delete it. After the retention period, the key and its version are permanently deleted.
149
188
189
+
150
190
## Symmetric encryption
151
191
152
192
Symmetric encryption is a fundamental type of cryptographic method where the same key is used to both encrypt and decrypt data. This means that the sender and receiver must have access to the same secret key, which they use to secure their communication.
153
193
154
194
Because symmetric encryption relies on a single key, it is generally fast and ideal for encrypting large volumes of data. However, its security depends entirely on keeping the key confidential.
155
195
156
-
Symmetric encryption algorithms like AES are widely used in scenarios where speed and efficiency are critical. As of now, Key Manager only supports the `AES_256_GCM` symmetric encryption algorithm.
196
+
Symmetric encryption algorithms like AES are widely used in scenarios where speed and efficiency are critical. As of now, Key Manager only supports the `AES_256_GCM` symmetric encryption algorithm.
## Which algorithms and key usage does Key Manager support?
32
35
33
36
<Encryption />
34
37
35
-
Keys with a [key usage](/key-manager/concepts/#key-usage) set to `symmetric_encryption` are **used to encrypt and decrypt data**.
38
+
Key Manager supports multiple [key usages](/key-manager/concepts/#key-usage) to suit different cryptographic operations:
39
+
40
+
- Keys with a usage set to `symmetric_encryption` are used to encrypt and decrypt data using symmetric algorithms.
41
+
- Keys with a usage set to `asymmetric_encryption` are used for encrypting and decrypting data with asymmetric algorithms, typically involving a public-private key pair.
42
+
- Keys with a usage set to `asymmetric_signing` are used for generating and verifying digital signatures, ensuring data authenticity and integrity.
36
43
37
44
Refer to our [dedicated documentation](/key-manager/reference-content/understanding-key-manager/) to find out more about Key Manager.
## Management methods you can use with Key Manager
56
58
@@ -74,13 +76,15 @@ Upon key creation, Key Manager automatically creates a first key version.
74
76
75
77
## Key usage and algorithms
76
78
77
-
The key usage specifies the [encryption algorithm](/key-manager/concepts/#encryption-algorithm) used to create subsequent key versions, and the **scope of cryptographic operations** supported by the key.
79
+
The key usage specifies the [encryption algorithm](/key-manager/concepts/#encryption-algorithm)or [signing algorithm](/key-manager/concepts/#signature)used to create subsequent key versions, and defines the **scope of cryptographic operations** supported by the key.
78
80
79
-
Keys with a key usage set to `symmetric_encryption` are **used to encrypt and decrypt data**.
81
+
- Keys with a key usage set to `symmetric_encryption` are used to encrypt and decrypt data using symmetric algorithms.
82
+
- Keys with a key usage set to `asymmetric_encryption` are used to encrypt and decrypt data using asymmetric algorithms.
83
+
- Keys with a key usage set to `asymmetric_signing` are used to generate and verify digital signatures.
80
84
81
85
<KeyManagerEncryption />
82
86
83
-
The following parameters, in compliance with the [recommendations of the French Cybersecurity Agency (ANSSI)](https://cyber.gouv.fr/publications/mecanismes-cryptographiques), are used when creating and using a key with the `AES-256 GCM`[encryption scheme](/key-manager/concepts/#encryption-scheme).
87
+
The following parameters, in compliance with the [recommendations of the French Cybersecurity Agency (ANSSI)](https://cyber.gouv.fr/publications/mecanismes-cryptographiques), are used when creating and using a key.
84
88
85
89
### Key derivation algorithm
86
90
@@ -92,9 +96,12 @@ Key Manager generates a 256-bit key using a cryptographically secure random numb
92
96
93
97
### Key version length
94
98
95
-
The key version has a length of 256 bits, ensuring strong cryptographic security.
99
+
For symmetric encryption, the key version has a length of 256 bits, ensuring strong cryptographic security.
100
+
The key size for asymmetric keys depends on the encryption algorithm used:
101
+
- RSA key sizes. Common key sizes are 2048, 3072, or 4096 bits
102
+
- EC key sizes. Common key sizes are 256 bits (known as P-256) and 384 bits (known as P-384)
96
103
97
104
### Block cipher
98
105
99
-
For encryption, Key Manager uses the Galois/Counter Mode (GCM), which is a mode of operation for block ciphers, with a block size of 128 bits. GCM encrypts your plaintext data using AES, and authenticates it using a unique "tag". This means that if anyone tampers with your data, you will know because the tag will not match anymore.
106
+
For symmetric encryption, Key Manager uses the Galois/Counter Mode (GCM), which is a mode of operation for block ciphers, with a block size of 128 bits. GCM encrypts your plaintext data using AES, and authenticates it using a unique "tag". This means that if anyone tampers with your data, you will know because the tag will not match anymore.
0 commit comments