Protecting Encryption Keys with Azure Key Vault
summary
Shows how to set up Azure Key Vault backed by HSMs (nShield Connect) and code against it, with concrete costs like 3 cents per 10,000 ops and HSM keys billed around $1 per key (higher for 3072/4096-bit). Demonstrates local key wrapping: generate a local AES key, encrypt it with a Key Vault RSA key, store the wrapped key in DB, decrypt once per session to cut latency and costs. Covers secrets (25 KB), key rotation (example: monthly rotation, per-tenant keys for multi-tenant insurance), PBKDF2 password salts stored encrypted, and Key Vault digital signatures.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:53Data Breaches
- 3:56Encryption
- 8:30Key Management
- 16:13Demo
- 16:46Sample Code
- 19:47Patterns and Practices
- 23:53Local Key Wrapping
- 32:25Key Version
- 33:32Password Protection
- 39:10Password Protection Example
- 42:23Digital Signatures
- 47:57Summary
related talks
01h 03mProtecting Encryption Keys with Azure Key Vault
59mProtecting Encryption Keys with Azure Key Vault
57mProtecting Encryption Keys with Azure Key Vault
47mManaging your Secrets in a Cloud Environment
10mCan you keep it a secret?
48mProtecting the confidentiality and integrity of your high value data with Azure SQL and SQL Server 2
51mKey Management 101: DEKs, KEKs, and Credentials Living Together, Oh My!
43mConfidential development with Always Encrypted using enclaves