2

I want to encrypt storage/volumes using customer supplied keys. I have seen examples where symmetric customer keys can be imported and used to encrypt volumes for example in case of EBS volumes in AWS. But no examples where customers can supply asymmetric keys such that public key resides in cloud kms and private keys are held only by the customers. Is it possible to import your own keys into a cloud KMS by providing asymmetric keys?

devcloud
  • 391
  • 5
  • 18

1 Answers1

3

You can "bring your own key" to Google Cloud KMS by importing symmetric or private asymmetric keys: the documentation is here - https://cloud.google.com/kms/docs/key-import. AWS has a similar feature for symmetric keys only, the documentation is here - https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys.html.

However, in both these situations the KMS holds a private key, whether symmetric or asymmetric, so that you can do secure operations inside the KMS. When you want to keep the private key and only send a public key to the KMS, I'm uncertain of what architecture you want.

If you want to retain private control over key material, GCP supports it through the "External Key Manager", which allows you to "hold your own key". Docs are here: https://cloud.google.com/kms/docs/ekm. As far as I know, Amazon has no equivalent.

Disclosure: I work at Google Cloud on key management solutions, including KMS and EKM.

Tim Dierks
  • 2,168
  • 15
  • 28
  • Thanks for your reply. So if i understood correctly, in case of importing asymmetric keys into Google KMS, only private keys need to be imported into the KMS while public keys are at client side? – devcloud Aug 03 '20 at 07:34
  • Since you work with EKM, i would appreciate if you could tell me that in case of using an EKM, can the externally managed key be used to encrypt persistent storage/volumes in case of google kubernetes engine (GKE)? – devcloud Aug 03 '20 at 07:44
  • Re: KMS, yes, you can import the private key (for example a private RSA key) while keeping the public key external. Re: EKM support for GKE -- I can't find the public documentation for supported integrations right now, but I believe it should work fine. – Tim Dierks Aug 03 '20 at 12:38