Google Introduces Cloud-Based Encryption Key Management Service
- Share
-
- |
Read later
My Reading List
Google has announced a new service for its Google Cloud Platform (GCP) that allows to create, use, rotate, and destroy symmetric encryption keys. Although the new Cloud Key Management Service (KMS) is integrated with Google's Cloud Identity Access Management and Cloud Audit Logging, keys managed using KMS can be also used independently.
Previous to Google KMS, Google Cloud Platform users could either choose to let GCP automatically handle cryptographic keys for them, or provide their own keys for server-side encryption. Google Key Management Service brings now the possibility to manage cloud-based keys and to encrypt and decrypt data using them via an API. Google Cloud KMS also allows to rotate keys, either manually or based on a schedule. When keys are rotated, old ones remain active for decryption while only one primary key is used for encrypting new data.
According to Google, Cloud KMS is able to easily handle millions of encryption keys and provides low latency access to keys. It is worth noting that GCP encrypts data by breaking it into subfile chunks, which each chunk encrypted using its own individual data encryption key (DEK). DEKs, are stored near the data they encrypt and are protected using a key encryption key (KEK), which is what you manage using Cloud KMS.
Google Cloud KMS uses AES256 keys provided by Google's open source BoringSSL library. Google additionally remarks their algorithm works in Galois/Counter Mode, which aims to provide authenticated encryption at high data rates thanks to the use of pipelines or parallelization.
Rate this Article
- Editor Review
- Chief Editor Action
Submit
Submit
Hello stranger!
You need to Register an InfoQ account or Login or login to post comments. But there's so much more behind being registered.Get the most out of the InfoQ experience.
Tell us what you think
Community comments
What could possibly go wrong
by
Lord Fire
Posted
