Key Management Service:Key specifications for symmetric and Asymmetric encryption

Symmetric encryption

Symmetric encryption uses the same key to encrypt and decrypt data. KMS keeps symmetric key material confidential to prevent unauthorized access.

Asymmetric encryption

An asymmetric key consists of a public key and a private key that are mathematically related. The public key is accessible to all users. The private key can be used only by the owner or trusted users. KMS ensures the security of the private key and does not support export of private keys by calling operations.

After you create an asymmetric key, get the public key from the KMS console or by calling the GetPublicKey operation.

Asymmetric keys support two key purposes:

• ENCRYPT/DECRYPT: Call the Encrypt operation with the public key to encrypt data, and the Decrypt operation with the private key to decrypt it. This is suited for distributing small amounts of confidential data, such as symmetric keys.

• SIGN/VERIFY: Call the Sign operation with the private key to generate a digital signature, and the Verify operation with the public key to verify it.

Specify the key purpose when you create an asymmetric key.

Asymmetric cryptographic operations are computationally intensive. For encrypting bulk data, use symmetric encryption and distribute the symmetric key using an asymmetric key pair.