Understanding Data Key Pairs in AWS KMS

Introduction

Data key pairs in AWS KMS are essential tools in managing encryption and decryption, signing, and verification processes outside of AWS KMS. These pairs consist of a public key and a private key that are mathematically related. 

Key Characteristics of Data Key Pairs

1. Asymmetric Nature: Each pair comprises a public key (used for encryption or signature verification) and a private key (used for decryption or signing).
2. Client-side Usage: Primarily designed for client-side operations, not within AWS KMS.
3. Protection of Private Key: The private key is encrypted and protected by a symmetric encryption KMS key specified by the user.
4. User Responsibility: AWS KMS does not store, manage, or track these key pairs, nor does it perform cryptographic operations with them.

Types of Data Key Pairs in AWS KMS

1. RSA Key Pairs: Options include RSA_2048, RSA_3072, and RSA_4096.
2. Elliptic Curve Key Pairs: Variants like ECC_NIST_P256, ECC_NIST_P384, ECC_NIST_P521, and ECC_SECG_P256K1.
3. SM Key Pairs: Available only in China Regions, specifically SM2.

Use Cases and Selection Criteria

• RSA keys are commonly used in most certificates.
• Elliptic curve keys are favored for digital signatures.
• ECC_SECG_P256K1 is typically used in cryptocurrency contexts.
• AWS KMS advises using ECC key pairs for signing and RSA key pairs for encryption or signing, but not both.

Creating a Data Key Pair

Options:

1. GenerateDataKeyPair: Provides a plaintext public key, a plaintext private key, and an encrypted private key. Ideal for immediate use cases like digital signature generation.
2. GenerateDataKeyPairWithoutPlaintext: Offers a plaintext public key and an encrypted private key without a plaintext private key. Suitable for scenarios where immediate use of a private key is not required.

Encrypting and Decrypting with Data Key Pairs

• Encryption: Use the public key to encrypt data.
• Decryption: Utilize the private key to decrypt. Ensure the keys are from the same pair and the same encryption algorithm is applied.

Signing and Verifying Messages

• Signing: Employ the private key to generate a cryptographic signature.
• Verifying: Use the public key to confirm the authenticity and integrity of the signed message.

Important Points to Remember for Exams

1. Asymmetric Key Nature: Comprehend the distinct roles of public and private keys.
2. Key Types: Know the different types of key pairs and their typical applications.
3. AWS KMS’s Role: Understand that AWS KMS does not manage or perform operations with these key pairs.
4. Key Creation Options: Distinguish between GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext.
5. Encryption/Decryption Process: Familiarize with the process of encrypting with a public key and decrypting with a private key.
6. Signing and Verification: Grasp how to sign messages with private keys and verify them with public keys.
7. User Responsibility: Remember the user’s responsibility for managing and using the data key pairs.

Conclusion

This guide offers a foundational understanding of data key pairs in AWS KMS, catering to beginners and those preparing for related exams. It’s crucial to delve deeper into each aspect for comprehensive knowledge and practical application skills.