KMS

Question 1

How would you decrypt data locally?

Answer 1

1. Use the Decrypt operation to decrypt the encrypted data key. The operation returns a plaintext copy of the data key.
2. Use the plaintext data key to decrypt data locally, then erase the plaintext data key from memory.

Question 2

What is used for decryption: an encrypted or a plaintext key?

Answer 2

plaintext

Question 3

How would you encrypt data locally?

Answer 3

1. Use the GenerateDataKey operation to get a data encryption key.
2. Use the plaintext data key (returned in the Plaintext field of the response) to encrypt data locally, then erase the plaintext data key from memory.
3. Store the encrypted data key (returned in the CiphertextBlob field of the response) alongside the locally encrypted data.

Question 4

When should you consider using AWS CloudHSM instead of AWS KMS ?

Answer 4

if you require:

– Keys stored in dedicated, third-party validated hardware security modules under your exclusive control.

– FIPS 140-2 compliance.

– Integration with applications using PKCS#11, Java JCE, or Microsoft CNG interfaces.

– High-performance in-VPC cryptographic acceleration (bulk crypto).