Overview

Exoscale Key Management Service (KMS) is a centralized, fully managed security service that enables you to create, control, and manage the lifecycle of cryptographic keys. It provides data encryption capabilities across your Exoscale workloads, custom applications, and external integrations.

Fundamentally, data encryption shifts the security challenge from protecting the data to protecting the keys. Exoscale KMS addresses this by defining a secure key hierarchy that cryptographically wraps your generated Data Encryption keys. It safeguards your assets while offering granular operations for access and control. The keys you create never leave the KMS environment unencrypted. All management and usage operations are executed securely through the Exoscale KMS API.

Terminology

Key types

KMS Key

A customer-controlled cryptographic key managed within Exoscale KMS. It serves as a master key used to securely wrap and protect Data Encryption Keys (DEKs), rather than encrypting data directly.

Data Encryption Key (DEK)

A key used to encrypt and decrypt actual customer data at rest. DEKs are generated on-demand and are never stored in plaintext by the KMS.

Default Organization Key

A platform-managed KMS key automatically provisioned for every Exoscale organization upon onboarding. It guarantees that baseline encryption workflows are available out-of-the-box without additional setup. This key is fully managed by Exoscale, it may not be deleted or disabled, it is replicated in all Exoscale zones at all times and you may not modify or disable its rotation schedule.

Encryption Concepts

Envelope Encryption

A security practice where data is encrypted with a Data Encryption Key (DEK), and the DEK itself is then encrypted (wrapped) by a higher-level KMS key. This localizes the impact of a potential compromise and simplifies key rotation.

Key Material

The raw cryptographic bytes that constitute a key, used to perform encryption, decryption or wrapping operations.

Key Rotation

The process of generating fresh versioned cryptographic key material of a KMS key. After rotation, legacy versions remain authorized exclusively for decrypting existing data, while the latest version is automatically used for all new encryption operations.

Additional Authenticated Data (AAD)/Encryption Context

Non-confidential, customer-provided data bound cryptographically to the ciphertext. It is used in ciphertext integrity checks.

Key Deployment

Multi-Zone Key

A KMS key that may be replicated across multiple Exoscale zones.

Primary Key

A Multi-Zone Key in the creation zone. The primary key dictates shared key lifecycle properties across all zone replicas.

Replica Key

A copy of a primary key in another Exoscale zone. It operates as a fully functional key for zone-local cryptographic operations, while its baseline lifecycle states (e.g., rotation, deletion) remain synchronized with the primary key.

Features & Use Cases

Protection of Data at rest

Exoscale KMS integrates seamlessly with the broader Exoscale ecosystem to secure your infrastructure assets automatically. By utilizing either custom KMS keys or the Default Organization Key, server-side encryption is enforced across your cloud resources to ensure that data at-rest is always encrypted.

• Exoscale Object Storage (SOS): Secure your buckets and objects. In KMS mode, each object is encrypted using a unique Data Encryption Key (DEK) wrapped by your specified KMS key.

• Compute: Root Volumes are encrypted at-rest. The Compute orchestrator will leverage your default KMS key, unless specified otherwise (i.e., a KMS key of your choice).

Encrypt and decrypt data

For custom software and automated workflows, Exoscale KMS provides direct access via the Exoscale API, client SDKs, and CLI to secure application-level data. This enables developers and operators to implement robust data protection patterns directly within their applications and deployment pipelines.

• Direct Payload Cryptography: Safely encrypt and decrypt small, sensitive data payloads—such as application configuration secrets, connection strings, certificates, or API tokens—directly through the CLI, SDKs, or API endpoints.

• High-Performance Envelope Encryption: For large files or databases, use Exoscale KMS to generate on-demand Data Encryption Keys (DEKs). Your application receives a plaintext DEK for immediate, high-speed local encryption and a wrapped (encrypted) DEK. You can store the wrapped DEK safely alongside your data, ensuring the master key material never leaves the KMS.

Cryptographic Primitives

Symmetric Encryption and Data Integrity

Exoscale KMS utilizes the Advanced Encryption Standard (AES) in Galois/Counter Mode (GCM) with 256-bit keys for symmetric key operations. AES-GCM is an authenticated encryption scheme that not only encrypts plaintexts but also generates an authentication tag. This tag is computed over both the ciphertext and any Additional Authenticated Data (AAD)—non-confidential context used to authenticate the ciphertext. This ensures the complete integrity and authenticity of your data, guaranteeing that any tampering or unauthorized modifications will be reliably detected.

To further secure cryptographic operations, Exoscale KMS employs Key Derivation Functions (KDF) to generate additional keys from an initial secret. Specifically, we use the HMAC-based Extract-and-Expand Key Derivation Function (HKDF), combining the initial secret with a unique, randomly generated salt. This derives a distinct, per-call key for encryption operations performed under a KMS key.

Data Protection via Envelope Encryption

To provide robust security guarantees for key lifecycle management, Exoscale KMS relies on Envelope Encryption. This is the practice of encrypting plaintext data with a data key, and then encrypting (or “enveloping”) that data key under another master key encryption key.

Exoscale KMS utilizes a tiered key hierarchy to achieve this. Your organization’s KMS keys are protected by a secure, long-term root key. In turn, your KMS keys are used to encrypt Data Encryption Keys (DEKs) on demand, which are then used to encrypt your actual data. When an authorized user or service needs to access encrypted data, the system first decrypts the enveloped DEK using your KMS key, and then uses that plaintext DEK to decrypt the underlying message.

Key Hierarchy

Encryption and Decryption of KMS Keys

Encrypt Operation

When encrypting data (or Data Encryption Keys) using a KMS key, Exoscale KMS employs a key-committing scheme to provide strict security guarantees that go beyond standard AES-GCM. The encryption process follows these steps:

1. Key Lookup: The service validates the infrastructure Root Key and securely retrieves the KMS key material associated with your specified Key ID.
2. Salt Generation: A 32-byte random salt is securely generated for the operation.
3. Key Derivation: Using the HMAC-based Extract-and-Expand Key Derivation Function (HKDF), the service derives two ephemeral keys from your KMS key and the salt:
   • A temporary Data Encryption Key.
   • A signature key.
4. AAD Construction: Additional Authenticated Data (AAD) is assembled by combining server-side context with any optional AAD provided by you via the encryption-context field in the request payload.
5. Encryption: The plaintext is encrypted using AES-GCM with the derived ephemeral DEK and the constructed AAD.
6. Payload Formatting: The resulting ciphertext is serialized into a secure Exoscale format that includes the cipher format version, ciphertext length, the ciphertext itself, and a resource identifier.
7. Authentication Tagging: An HMAC-SHA256 signature is computed over the serialized payload and the salt using the derived signature key.
8. Final Assembly: The service returns the final, secure payload containing the formatted ciphertext blob, the salt, and the authentication tag.

Decrypt Operation

The KMS strictly verifies the payload’s integrity before attempting any decryption. The decryption process is as follows:

1. Ciphertext Parsing: The provided payload is parsed to extract the ciphertext blob, salt, HMAC tag, and KMS key version.
2. Key Lookup: The corresponding KMS key material is retrieved using the Key ID, version, and the infrastructure Root Key.
3. Key Derivation: The ephemeral DEK and signature keys are securely re-derived via HKDF using the retrieved KMS key and the extracted salt.
4. Integrity Check: The HMAC-SHA256 tag is recomputed over the blob and salt. If the recomputed tag does not perfectly match the provided tag, the operation aborts immediately, returning an invalid ciphertext error.
5. AAD Reconstruction: The exact AAD used during the encryption phase is rebuilt.
6. Decryption: The ciphertext is decrypted using AES-GCM with the derived DEK and rebuilt AAD, safely returning the plaintext to the authorized client.

Generation of Data Encryption Keys (DEK)

When you request a Data Encryption Key to encrypt your local data, Exoscale KMS generates it dynamically and securely:

1. A random key of your requested length or specification is generated using a secure cryptographic random number generator.
2. This plaintext key is immediately encrypted under your target KMS key using the standard Encrypt Operation detailed above.
3. The service returns both the plaintext DEK and the encrypted (ciphertext) DEK to your application.

Security Best Practice: Exoscale KMS never stores or persists your DEKs. It is the client application’s responsibility to use the plaintext DEK strictly in memory to encrypt data, store the ciphertext DEK alongside the encrypted data, and safely discard the plaintext DEK from memory once the operation is complete.

Re-encryption

The Re-encryption operation allows you to transition encrypted data (such as an enveloped DEK) from one KMS key to another without ever exposing the plaintext to your application layer or the network.

1. The service performs a Decrypt operation within its secure boundary using the source KMS Key and your source AAD to recover the plaintext.
2. It then immediately performs an Encrypt operation on that plaintext using the new target KMS Key and target AAD.
3. The newly generated ciphertext is returned to your application.

KMS Key Rotation

Key rotation enhances security by generating new cryptographic material for a KMS Key, incrementing its version while keeping the underlying Key ID identical. This ensures your applications do not need to be updated with new key identifiers.

• Rotation Constraints: Keys can be rotated automatically (based on a schedule you define) or manually. Manual rotation is limited to a maximum of 10 times per key. To be rotated, a key must belong to Exoscale KMS, have an EncryptDecrypt usage scope, and must not be disabled or pending deletion. For multi-zone keys, rotation can only be triggered from the key’s designated origin zone.
• Rotation Process: The KMS generates new encrypted key material tied to the infrastructure Root Key. The key’s version and revision numbers are incremented, and the new cryptographic material is appended securely to the database.
• Multi-Zone Replication: If the rotated key is multi-zone enabled, the KMS automatically synchronizes the new key material asynchronously across all of your configured replica zones.