You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: pages/key-manager/concepts.mdx
+46-7Lines changed: 46 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -18,6 +18,12 @@ The public key is used for encryption and can be shared openly, while the privat
18
18
19
19
Asymmetric encryption is particularly well-suited for secure communication and authentication, such as encrypting emails or verifying digital signatures. However, it is slower than symmetric encryption. Algorithms like RSA and ECC are common examples of asymmetric encryption.
20
20
21
+
As of now, Key Manager currently supports the following asymmetric encryption algorithms:
22
+
23
+
- RSA-OAEP-2048-SHA256: RSA encryption with 2048-bit key and OAEP padding using SHA-256.
24
+
- RSA-OAEP-3072-SHA256: RSA encryption with 3072-bit key and OAEP padding using SHA-256. (recommended)
25
+
- RSA-OAEP-4096-SHA256: RSA encryption with 4096-bit key and OAEP padding using SHA-256.
26
+
21
27
## Ciphertext
22
28
23
29
Ciphertext refers to data that has been encrypted using a cryptographic algorithm and a key.
@@ -31,11 +37,13 @@ Ciphertext can be encrypted on the client side as long as the encryption key use
31
37
32
38
A cryptographic operation is any action performed using cryptography to secure data, ensure privacy, or authenticate information.
33
39
34
-
Key Manager supports the three following cryptographic operations:
40
+
Key Manager supports the five following cryptographic operations:
These operations are designed to protect data from unauthorized access, ensure its integrity, and verify the identities of users or systems.
41
49
@@ -57,7 +65,7 @@ The only way to decrypt an encrypted payload is by using the `Decrypt` [endpoint
57
65
58
66
A cryptographic operation used to encrypt data using the latest version of the Key Manager key. The [encryption algorithm](#encryption-algorithm) used is the one defined when setting the [key usage](#key-usage).
59
67
60
-
Only keys with a usage set to `symmetric_encryption` are supported by this method. The input data is arbitrary, but this endpoint should only be used to encrypt **data encryption keys**, not actual [payloads](#payload).
68
+
The input data is arbitrary, but this endpoint should only be used to encrypt **data encryption keys**, not actual [payloads](#payload).
61
69
62
70
[Find out how to encrypt and decrypt payloads using The Scaleway Tink provider](/key-manager/api-cli/manage-keys-with-tink)
63
71
@@ -67,21 +75,27 @@ An encryption algorithm is the specific procedure used to perform encryption and
67
75
68
76
It defines the exact steps to transform plaintext into ciphertext and vice versa using a key.
69
77
70
-
As of now, Key Manager supports the following encryption algorithm:
78
+
As of now, Key Manager supports the following **symmetric**encryption algorithm:
71
79
72
80
- AES (Advanced Encryption Standard): A widely used symmetric encryption algorithm.
73
81
82
+
It also supports the following **asymmetric** encryption algorithms:
83
+
84
+
- RSA-OAEP-2048-SHA256: RSA encryption with 2048-bit key and OAEP padding using SHA-256.
85
+
- RSA-OAEP-3072-SHA256: RSA encryption with 3072-bit key and OAEP padding using SHA-256. (recommended)
86
+
- RSA-OAEP-4096-SHA256: RSA encryption with 4096-bit key and OAEP padding using SHA-256.
87
+
74
88
## Encryption method
75
89
76
90
An encryption method is a broader approach used to convert readable data ([plaintext](#plaintext)) into an unreadable format ([ciphertext](#ciphertext)) which may involve one or more [encryption algorithms](#encryption-algorithm).
77
91
78
92
There are three types of encryption methods:
79
93
80
94
-[Symmetric encryption](#symmetric-encryption)
81
-
-[Asymmetric encrytpion](#asymmetric-encryption)
95
+
-[Asymmetric encryption](#asymmetric-encryption)
82
96
- Hybrid encryption: An encryption method that combines both symmetric and asymmetric methods
83
97
84
-
Key Manager only supports symmetric encryption.
98
+
Key Manager supports symmetric and asymmetric encryption.
85
99
86
100
## Encryption scheme
87
101
@@ -116,14 +130,16 @@ When using [symmetric encryption](#symmetric-encryption), it is generally recomm
116
130
117
131
After rotating your Key Manager keys, all cryptographic operations will use the new rotated keys. All data encrypted with former key versions will remain decipherable with the former key.
118
132
133
+
Key rotation is only available for symmetric keys.
134
+
119
135
## Key usage
120
136
121
137
The key usage specifies the **algorithm** used to create subsequent key versions, and the **scope of cryptographic operations** supported by your key encryption key.
122
-
You must define a key usage upon key creation. As of now, Key Manager **only supports symmetric encryption**.
138
+
You must define a key usage upon key creation. Key Manager supports symmetric encryption, asymmetric encryption and asymmetric signing.
123
139
124
140
## Key version
125
141
126
-
A key version is a a specific iteration of your key encryption key. Each version of your key represents a distinct state or version that may be [rotated](#key-rotation) or replaced over time.
142
+
A key version is a specific iteration of your key encryption key. Each version of your key represents a distinct state or version that may be [rotated](#key-rotation) or replaced over time.
127
143
128
144
Key versions allow you to manage and track changes to your data encryption keys. When using key versions, all cryptographic operations will rely on the current key version.
129
145
@@ -145,6 +161,29 @@ A region refers to the **geographical location** in which your key will be creat
145
161
146
162
A root encryption key (REK) is another type of key that has the single purpose of encrypting and decrypting KEKs in order to store them in hard storage. Scaleway's Key Manager has one REK per region, which is securely stored in our facilities.
147
163
164
+
## Signature
165
+
166
+
Signature is a cryptographic technique used to ensure the authenticity and integrity of data. In this process, a digest (hash) of the message is created and then signed using a private key. This signature can later be verified by anyone with access to the corresponding public key.
167
+
168
+
Signatures are widely used in scenarios like document signing, secure communication, and identity verification. They offer assurance that the data originated from a trusted source and has not been tampered with.
169
+
170
+
As for now, Key Manager supports the following asymmetric signing algorithms:
171
+
172
+
- EC-P256-SHA256: ECDSA signing with the P-256 curve and SHA-256. (recommended)
173
+
- EC-P384-SHA256: ECDSA signing with the P-384 curve and SHA-384.
174
+
- RSA-PSS-2048-SHA256: RSA-PSS signing with 2048-bit key and SHA-256.
175
+
- RSA-PSS-3072-SHA256: RSA-PSS signing with 3072-bit key and SHA-256.
176
+
- RSA-PSS-4096-SHA256: RSA-PSS signing with 4096-bit key and SHA-256.
177
+
- RSA-PKCS1-2048-SHA256: RSA PKCS#1 v1.5 signing with 2048-bit key and SHA-256.
178
+
- RSA-PKCS1-3072-SHA256: RSA PKCS#1 v1.5 signing with 3072-bit key and SHA-256.
179
+
- RSA-PKCS1-4096-SHA256: RSA PKCS#1 v1.5 signing with 4096-bit key and SHA-256.
180
+
181
+
## Signature verification
182
+
183
+
Signature verification is the process of confirming the authenticity and integrity of a digital signature.
184
+
It involves using the public key corresponding to the private key that was used to create the signature to verify that the data has not been altered and that it comes from the claimed sender.
185
+
This process is crucial for ensuring secure and reliable communication.
186
+
148
187
## Symmetric encryption
149
188
150
189
Symmetric encryption is a fundamental type of cryptographic method where the same key is used to both encrypt and decrypt data. This means that the sender and receiver must have access to the same secret key, which they use to secure their communication.
## Which algorithms and key usage does Key Manager support?
34
37
35
38
<Macroid="encryption" />
36
39
37
-
Keys with a [key usage](/key-manager/concepts/#key-usage) set to `symmetric_encryption` are **used to encrypt and decrypt data**.
40
+
Key Manager supports multiple [key usages](/key-manager/concepts/#key-usage) to suit different cryptographic operations:
41
+
42
+
- Keys with a usage set to `symmetric_encryption` are used to encrypt and decrypt data using symmetric algorithms.
43
+
- Keys with a usage set to `asymmetric_encryption` are used for encrypting and decrypting data with asymmetric algorithms, typically involving a public-private key pair.
44
+
- Keys with a usage set to `asymmetric_signing` are used for generating and verifying digital signatures, ensuring data authenticity and integrity.
38
45
39
46
Refer to our [dedicated documentation](/key-manager/reference-content/understanding-key-manager/) to find out more about Key Manager.
## Management methods you can use with Key Manager
56
58
@@ -74,13 +76,15 @@ Upon key creation, Key Manager automatically creates a first key version.
74
76
75
77
## Key usage and algorithms
76
78
77
-
The key usage specifies the [encryption algorithm](/key-manager/concepts/#encryption-algorithm) used to create subsequent key versions, and the **scope of cryptographic operations** supported by the key.
79
+
The key usage specifies the [encryption algorithm](/key-manager/concepts/#encryption-algorithm)or [signing algorithm](/key-manager/concepts/#signature)used to create subsequent key versions, and defines the **scope of cryptographic operations** supported by the key.
78
80
79
-
Keys with a key usage set to `symmetric_encryption` are **used to encrypt and decrypt data**.
81
+
- Keys with a key usage set to `symmetric_encryption` are used to encrypt and decrypt data using symmetric algorithms.
82
+
- Keys with a key usage set to `asymmetric_encryption` are used to encrypt and decrypt data using asymmetric algorithms.
83
+
- Keys with a key usage set to `asymmetric_signing` are used to generate and verify digital signatures.
80
84
81
85
<Macroid="key-manager-encryption" />
82
86
83
-
The following parameters, in compliance with the [recommendations of the French Cybersecurity Agency (ANSSI)](https://cyber.gouv.fr/publications/mecanismes-cryptographiques), are used when creating and using a key with the `AES-256 GCM`[encryption scheme](/key-manager/concepts/#encryption-scheme).
87
+
The following parameters, in compliance with the [recommendations of the French Cybersecurity Agency (ANSSI)](https://cyber.gouv.fr/publications/mecanismes-cryptographiques), are used when creating and using a key.
84
88
85
89
### Key derivation algorithm
86
90
@@ -92,9 +96,12 @@ Key Manager generates a 256-bit key using a cryptographically secure random numb
92
96
93
97
### Key version length
94
98
95
-
The key version has a length of 256 bits, ensuring strong cryptographic security.
99
+
For symmetric encryption, the key version has a length of 256 bits, ensuring strong cryptographic security.
100
+
The key size for asymmetric keys depends on the encryption algorithm used:
101
+
- RSA key sizes. Common key sizes are 2048, 3072, or 4096 bits
102
+
- EC key sizes. Common key sizes are 256 bits (known as P-256) and 384 bits (known as P-384)
96
103
97
104
### Block cipher
98
105
99
-
For encryption, Key Manager uses the Galois/Counter Mode (GCM), which is a mode of operation for block ciphers, with a block size of 128 bits. GCM encrypts your plaintext data using AES, and authenticates it using a unique "tag". This means that if anyone tampers with your data, you will know because the tag will not match anymore.
106
+
For symmetric encryption, Key Manager uses the Galois/Counter Mode (GCM), which is a mode of operation for block ciphers, with a block size of 128 bits. GCM encrypts your plaintext data using AES, and authenticates it using a unique "tag". This means that if anyone tampers with your data, you will know because the tag will not match anymore.
0 commit comments