OCI KMS and Vault

In OCI, data at rest is highly secure because it is encrypted using Oracle-managed keys. However, for organizations with strict internal security requirements, OCI allows us to use Customer-Managed Keys. These keys are centrally generated, stored, and managed using the OCI Vault service which is a core component of OCI Key Management Service (KMS). KMS is a cloud-based service that provides centralized management and control of encryption keys for data stored in OCI.

MEK and Protection Modes

Inside a vault we create Master encryption keys (MEK) which we use to protect OCI resources. MEK can be configured with one of two protection modes: (Hardware Security Module)HSM-protected or software-protected. A HSM-protected master key is stored on an HSM where tenant share a single partition and keys can't be exported from HSM, all cryptographic operations involving the key also happens on the HSM. A Software-protected master key is stored on a server and can be exported from the server to perform cryptographic operations. A key's protection mode affects pricing and can't be changed after the key is created. For a dedicated, isolated partition on a physical HSM choose Virtual Private Vault.

Symmetric Key Cryptography and Asymmetric Key Cryptography

In the world where every thing is over the internet we need to secure the data whether it is in rest or in motion. This is where cryptography comes into play, it is the science of encryption and decryption of data to prevent unauthorized access. Encryption converts data from plaintext to Ciphertext and decryption reverses the process of encryption to retrieve the original information. There are two types of cryptography Symmetric and Asymmetric, both of which have the advantages and disadvantages.

• Symmetric Key Cryptography: The data is encrypted and decrypted using same key due to which the process is faster and it is usefull where the large amount of data is secured but this is less secure due to single point of failure.

• Asymmetric Key Cryptography: The data is encrypted and decrypted using two entirely different keys (private key & public key) which are mathematically linked. The encryption and decryption process is slower and it is usefull where the security of data is more important than the time.

Key Versions & Rotations

Each MEK is automatically assigned a key version. When we rotate a key, the KMS generates a new key version and can generate the key material(raw string of secret bits that is used by algorithms to encrypt and decrypt) for the new key version or we can import our own key material. When a key is rotated frequently then the amount of data signed or encrypted by one key version is comparatively less. If somehow a key is compromised so it will only expose that block of data which is signed or encrypted using that specific key.

• After rotation older key version can't be used for encryption but can be used to decrypt any data which was earlier encrypted using same key.
• In case of rotation of asymmetric key, older public key can't be used to encrypt data but older private key can be used to decrypt the data which was encrypted using that public key.
• If we rotate a asymmetric key which was used for digital signing, we can't use the older private key to sign data but using older public key we can verify the digital signature of data which was earlier signed using the older private key.
• For symmetric keys, we don't need to track which key version was used to encrypt what data because the key's ciphertext contains the information that the service needs for decryption purposes, but in case of asymmetric key we must track which key version was used to encrypt or sign what data.
• With AES symmetric keys, each key version counts as one key version when calculating service limits usage. However, with RSA and ECDSA asymmetric keys, each key version counts as two when calculating usage against service limits because an asymmetric key has both a public key and private key.

Automatic Key Rotation

This is an exclusive feature of the Virtual Private Vault which lets you schedule automatic key rotation for an encryption key. We configure automatic rotation by setting frequency of rotation and the start date. We can set a frequency between 60 days and 365 days. It supports automatic key rotation for both HSM and software keys , and symmetric and asymmetric keys. We can also send an event notification if a key rotation fails.

Creating Vault

1. Navigate

   Navigation menu > Identity & Security > Key Management > Vault > Create Vault
   

2. Select compute and storage compartment and give a relatable name

3. If you want to create a Virtual Private Vault click to enable and click create

Deleting Vault

There is not any direct way to delete vault but you can schedule deletion.

1. On the vaults page click on the three dot Actions menu of the specific vault

2. Enter the vault name and select deletion date and time finally click Delete Vault

3. If you change your mind and you want to cancle deletion then you can do it under scheduled time, just click on three dot actions menu again and click Cancel deletion

Creating Master encryption key

1. Navigate to the specific vault and go to Master encryption keys section and click Create key

2. Select Compartment & Protection Mode and enter a Name

3. Select Algorithm and Length and click Create Key

Rotating the Key

1. Click on the the three dot Action menu of the particular key and click Rotate Key

2. On the confirmation page either you can enable Import External key Version and import the new key or just you can leave it as it is and click Rotate Key

3. To see the key version click on the key name and navigate to Version

4. If you want you can delete older version keys