This topic describes symmetric encryption, which is the most commonly used data encryption method. KMS provides easy-to-use API operations that allow you to encrypt and decrypt data on the cloud.
If you do not specify the KeySpec parameter during key creation, KMS creates a symmetric key. KMS supports popular symmetric key algorithms and provides high-level data security by using strong cryptography.
Types of symmetric keys
|Algorithm||Key length||Key type||Data encryption mode||Protection level|
Encryption and decryption features
When you call the Encrypt, ReEncrypt, GenerateDataKey, or GenerateDataKeyWithoutPlaintext operation to encrypt data or data keys, you need to specify only a CMK ID or alias. KMS uses the specified CMK for encryption and returns ciphertext. When you call the Decrypt operation, you need to specify only the ciphertext that you want to decrypt. You do not need to specify a CMK.
Symmetric keys of KMS use GCM for block ciphers. You can use additional authenticated data (AAD) to provide supplemental protection for the integrity of encrypted data. KMS encapsulates AAD to enable you to customize authentication data. For more information, see EncryptionContext.
Rotation of symmetric keys
Each symmetric CMK that is generated in KMS supports multiple key versions. KMS automatically rotates CMKs by generating new key versions. You can customize the key rotation policy.
If a CMK has multiple versions, the latest version of the CMK is used to encrypt data or data keys in the Encrypt, GenerateDataKey, and GenerateDataKeyWithoutPlaintext operations. When you call the Decrypt operation, you do not need to specify a CMK ID or key version ID. KMS automatically identifies the CMK and its key version with which the corresponding data or data key is encrypted. Then, KMS uses the key material of the identified key version to decrypt the ciphertext.
KMS rotates a CMK by generating a new version of the CMK. After a rotation is complete, KMS automatically uses the new key version to encrypt data or data keys. However, the earlier key version is still available to decrypt the ciphertext generated before the rotation. For more information, see Configure automatic key rotation.
KMS allows you to encrypt your data on the cloud by using the Bring Your Own Key (BYOK) feature. This feature helps you meet stringent security and compliance requirements. We recommend that you use Managed HSM to protect your keys. You can import your key material into a CMK whose protection level is HSM. Keys in a managed HSM can only be destroyed, and their plaintext cannot be exported. For more information, see Import key material.