Secrets manager uses the well-tested AES 256 block cipher algorithm to protect your organization’s data. Encryption occurs before the information is stored on a disk using a hierarchy of cryptographic keys.
DEK is an AES 256-GCM symmetric key used for data encryption. KEK is a key designed to encrypt the DEK key, also known as the master key. The full master key is not stored and exists only in RAM using Shamir’s Secret Sharing Scheme for enhanced security. Encrypted DEK keys protected with the KEK master key, are stored separately.
To decrypt the data, the service must first decrypt the DEK key using the master key, then use that key to decrypt the data itself. When retrieving sensitive information, secrets manager decrypts the data and transmits them to the user’s local environment via a secure TLS connection.
Join the waitlist for the latest news, best deals and platform availability infomation.