Configuring KEKs

The Stormshield KMaaS uses key encryption keys, i.e., KEKs, to wrap and unwrap Data Encryption Keys (DEKs). The different services using the Stormshield KMaaS API (i.e., KACLS, Stormshield SDK) provide the DEKs to encrypt/decrypt data.

The KEKs are used by all the modules of Stormshield KMaaS.

There are three ways to store keys:

• Database mode: KEKs are stored in a PostgreSQL database dedicated to the Stormshield KMaaS. This mode provides a good level of security and does not require to implement a third party KMS. It is possible to add KEKs through the Admin module and they are loaded on demand. This mode requires the use of master KEKs (i.e., MKEKs).
• File mode: KEKs are stored in plaintext in the /etc/stormshield/cse/keks.json file on the server. Access to keys depends on how secure the server is.
• KMS mode: KEKs are stored in a Key Management System (KMS).
  The keys are selected in the KMS by using the value of the kacls_kek_label parameter in the config.json file. They are refreshed regularly, based on the value of the keks parameter in the config.json file. See keks parameter.

KEKs are highly sensitive items in terms of security. You must follow the ANSSI recommendations concerning their life cycle.