The service can encrypt data submitted by a user with a managed key and return the ciphertext without exposing the key material.
Encrypt Data
CCC.KeyMgmt.CP09
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.KeyMgmt.TH08 | A Single Key is Used for Multiple Cryptographic Purposes | A key may be created without a usage restriction, or with a restriction that permits both encryption and signing operations. The same key material is then exposed through two different cryptographic protocols, enabling cross-protocol attacks in which an oracle from one operation reveals information about the other. Confidentiality of data encrypted with the key and integrity of signatures produced with it are both weakened. |
| CCC.KeyMgmt.TH09 | External Key Store is Unavailable or Compromised | When keys are held in an external key manager, every encrypt and decrypt request depends on a network path to, and the correct operation of, infrastructure outside the provider. Loss of that path or of the external system halts all operations with those keys, and compromise of the external system exposes the key material or the plaintext data keys that pass through it. Availability of every workload that depends on the keys and confidentiality of the data they protect are affected. |