Using the DKE module

For each DKE key defined by its kid, the Stormshield KMaaS may store multiple key versions (i.e., version_id):

  • The most recent key version is automatically selected and used for encryption,

  • Older key versions are retained to allow decryption of previously encrypted DEKs,

  • Microsoft identifies a key version through its version_id when requesting decryption,

  • Key rotation is transparent for Microsoft and does not impact access to existing data.

Retrieving keys

When Microsoft needs to encrypt a DEK, it calls the Stormshield KMaaS GET /api/v1/{tenantid}/dke/{kid} route associated with the sensitivity label. The Stormshield KMaaS returns the most recent version of the public key in JWK format.

The kid field in the response is a URI identifying the exact key version which will be later reused by Microsoft for decryption requests.

For more information, see the API documentation.

Decrypting DEKs

When Microsoft needs to decrypt a DEK, the workflow is the following:

  1. Microsoft calls the Stormshield KMaaS POST /api/v1/{tenantid}/dke/{kid}/{versionId}/Decrypt route.

  2. The Stormshield KMaaS resolves the requested key version.

  3. It uses the associated private key to decrypt the encrypted DEK,

  4. It returns the plaintext DEK to Microsoft.

If the key version does not exist or is disabled, the request issues an error.

For more information, see the API documentation.