All news with #key management tag

🔒 Google Cloud announced the preview of quantum-safe key import for software-based keys in Cloud KMS, extending its post-quantum offerings including quantum-safe digital signatures and KEMs. The feature uses hybrid public key encryption (HPKE) to wrap keys in a quantum-resistant envelope during transit, mitigating store-now, decrypt-later risks. The import workflow integrates with existing Cloud KMS APIs and supports client-side wrapping via libraries like Tink and OpenSSL, with options for X-Wing, ML-KEM-768, or ML-KEM-1024 and AES-256-GCM for symmetric wrapping.

🔒 Google Cloud published a staged post-quantum migration roadmap on August 12, splitting work into three risk domains from its quantum threat model. The provider targets mitigating store-now-decrypt-later (SNDL) risks by end of 2027, with signature hardening and key management agility running to end of 2028. Several services already support hybrid NIST-standardized ML-KEM and related primitives, while others (Cloud VPN, Private CA, Cloud HSM) phase in through 2028. Google warns hardware replacement cycles may extend some transitions beyond 2029.

🔐 This post examines how NICE Actimize reduced AWS KMS costs by 77% for a multi-tenant, event-driven platform by rethinking data key caching. It outlines the cache stampede problem that arises when envelope encryption operates at high concurrency and describes two solutions: the AWS-recommended hierarchical keyring with DynamoDB branch keys and a custom CachedKmsClient using Caffeine caches. The article covers design, trade-offs, and security considerations for both patterns.

🔐 This post compares AWS KMS and AWS CloudHSM, explaining their differences, deployment models, pricing, region coverage, and typical use cases. It emphasizes that AWS KMS is the recommended, fully managed option for most workloads while CloudHSM is appropriate for legacy applications or strict dedicated-HSM requirements. The article outlines shared security assurances, compliance coverage, supported algorithms, and operational trade-offs to guide selection.

🔒 Google Cloud Key Management Service (Cloud KMS) now offers general availability support for quantum‑safe digital signatures (ML‑DSA, SLH‑DSA) and ML‑KEM post‑quantum key encapsulation. The release addresses the challenge of signing large payloads by supporting pre‑hash and external‑µ variants to enable efficient HSM and KMS signing workflows. Cloud KMS includes multiple ML‑DSA and SLH‑DSA variants mapped to NIST security categories to help organizations meet emerging standards and regulatory timelines. Developers can manage PQC keys and integrate signing via the Cloud KMS API with documentation and examples provided.

🔐 Amazon CloudWatch Synthetics now supports using customer managed AWS KMS keys to encrypt canary environment variables, allowing teams to control encryption for sensitive data such as API keys and tokens. Previously, only an AWS owned key was used; now you can specify a symmetric KMS key for at-rest encryption or perform client-side encryption and decrypt at runtime. This capability meets requirements for key management, auditability, and rotation and is available in all commercial AWS Regions, with multi-location canaries able to use per-replica Region keys.

🔐 Azure announces public preview of external key management for Managed HSM, enabling customers to keep key material on HSMs they own and operate outside Microsoft infrastructure. The feature connects Azure cryptographic operations to external HSMs via a dedicated API endpoint while keeping keys from ever residing in Azure. It targets scenarios with strict regulatory or contractual data-sovereignty requirements and shifts more operational responsibility to customers.

🔐 Today’s public-key cryptography faces a future threat from quantum computers that can render intercepted ciphertext and stored credentials decryptable. Agencies like the NSA and standards bodies such as NIST have set Q-day deadlines between 2027 and 2035 to phase in quantum-resistant algorithms, while enterprises face multi-year migrations. A practical approach is credentials-first: inventory secrets, prioritize long-lived, high-impact credentials, adopt hybrid cryptography, and design for crypto-agility to reduce Harvest Now, Decrypt Later risks.

🔐 Amazon Cognito now supports customer managed keys in AWS Key Management Service (KMS) to encrypt user pool data at rest. While AWS-owned keys remain the default, customer managed keys let organizations control key lifecycle and access policies to meet governance requirements. You can set a key when creating a new user pool or update an existing one, and audit key usage via AWS CloudTrail. Available in Essentials and Plus tiers with standard AWS KMS charges.

🔒 Elon Musk’s XChat launched on iOS in April 2026 as a purportedly private messaging alternative, but its encryption model and key handling have raised alarm among experts. XChat stores users’ private keys on servers protected by HSMs and uses four-digit PINs to encrypt those keys for multi-device sync, a design that undermines classic end-to-end guarantees. Practical issues — message requests sent without E2EE, confusing PIN prompts, and weak brute-force protection — further complicate user security. The net result: XChat offers convenience at the cost of meaningful privacy assurances.

🔐 AWS KMS introduced the GetKeyLastUsage API to report the date, time, operation type, CloudTrail event ID, and KMS request ID for the most recent cryptographic operation on a key. The feature works for customer-managed and AWS-managed keys across specs and origins and is visible in the AWS Management Console and AWS CLI. Tracking of last usage began on April 23, 2026 for most Regions, so historical gaps before tracking began should be considered. Use DisableKey, monitoring, and the kms:TrailingDaysWithoutKeyUsage condition to prevent accidental deletions.

🔒 Amazon Quick Research now supports encryption using customer-managed keys (CMKs) via AWS Key Management Service, enabling organizations to control encryption, auditing, and key lifecycle. Customers can use multiple CMKs with one default key per AWS account per region and must create CMKs in the same account and region as Quick resources. Only symmetric KMS keys are supported, and CloudTrail integration provides comprehensive audit trails and the ability to revoke compromised keys within 15 minutes. The feature is generally available in all AWS Regions where Amazon Quick is offered.

🔐 Amazon Quick Research now supports customer-managed keys (CMKs) via AWS Key Management Service (KMS), enabling organizations to manage encryption keys for their Quick data. Customer-managed keys provide enhanced control, CloudTrail-based auditing, and the ability to revoke compromised keys within 15 minutes. Only symmetric KMS keys created in the same account and region are supported, with one default CMK per account per region and support for multiple CMKs across datasets.

🔒 AWS announced the completion of PCI PIN and PCI P2PE assessments for AWS Payment Cryptography, expanding validations to include Key Management (KMCP) and Key Loading (KLCP) alongside the existing Decryption Management (DMCP). The coverage is extended to South America (São Paulo) and Asia Pacific (Sydney) Regions. These attestations allow customers to use PCI PTS HSM-certified, AWS-managed HSMs with compliant key management to simplify regulated deployments.

🔐 AWS announced support for cross-account key sharing in AWS Payment Cryptography using resource-based policies (RBP). Organizations can now maintain a single authoritative copy of cryptographic keys and grant per-resource access to other AWS accounts—internal or external—without import/export workflows. This reduces duplication, simplifies key lineage and access control, and helps teams scale cryptography operations in cloud-hosted payment applications. The feature is available in all Regions where the service runs; consult the user guide to get started.

🔐 AWS Payment Cryptography now offers Physical Key Exchange, a PCI PIN and P2PE-compliant option that enables paper-based cryptographic key exchange without customers having to maintain their own secure key-loading infrastructure. Paper key components are shipped to trained AWS key custodians, who perform key ceremonies in AWS-operated secure facilities meeting the required physical and logical controls. Once loaded, keys are available to the managed service for cryptographic operations, helping organizations accelerate migration when partners do not support electronic key exchange.

🔐 Microsoft is open-sourcing the firmware, drivers, and software stack for the Azure Integrated HSM, a tamper-resistant hardware security module built into new Azure servers and engineered to meet FIPS 140-3 Level 3. The move, announced at the OCP EMEA Summit, includes publishing validation artifacts and launching an OCP workgroup to guide ongoing development. Azure says the HSM protects keys in hardware so they never appear in host or guest memory, reducing classes of exfiltration attacks, and will be available in Azure V7 VMs globally in the coming weeks.

🔐 AWS Payment Cryptography now supports Multi-party approval (MPA) for importing root certificates, adding an extra governance layer to critical key management operations. Organizations using X.509 and PKI with asymmetric keys (RSA, ECC) can require two or more authorized approvers even if the requester holds IAM permissions. The capability integrates with AWS IAM Identity Center so teams can review and act on pending requests through a managed approval portal, and it is available in all regions where the service runs with no additional charge beyond standard API rates.

🔒 AWS Key Management Service (KMS) now surfaces the timestamp, operation type, and AWS CloudTrail event ID for the last cryptographic operation performed with each KMS key, viewable in the console or via API. This eliminates manual log queries and helps administrators and compliance teams quickly identify unused keys, verify active usage, and trace key activity. A new condition key, kms:TrailingDaysWithoutKeyUsage, enables policy-based protection against accidental deletion of recently used keys, and the capability is available in all AWS Regions including GovCloud and China.

🛡️ This AWS Security Blog post demonstrates how to clone an AWS CloudHSM cluster across Regions using the copy-backup-to-region workflow and Client SDK 5 (recommended version 5.17 or later). It walks through creating and initializing a source cluster, generating a backup, copying that backup to a destination Region, and launching a new cluster from the copied backup, including certificate transfer and security group adjustments. The guide emphasizes that non-exportable keys can only be synchronized to cloned clusters, that users and passwords must be maintained manually after the initial backup, and that Client SDK 3 reached end-of-support on January 1, 2025, so migration to SDK 5 is required.