Security pattern for delegating cryptographic operations and key management to an external service. Use when designing systems that should not possess cryptographic keys directly. Implementation of Cryptographic Key Management pattern. Examples include Android Keystore, iOS KeyChain, AWS KMS, Azure Key Vault, Google Cloud KMS. Reduces risk of key leakage and cipher misconfiguration.
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.
Security pattern for delegating cryptographic operations and key management to an external service. Use when designing systems that should not possess cryptographic keys directly. Implementation of Cryptographic Key Management pattern. Examples include Android Keystore, iOS KeyChain, AWS KMS, Azure Key Vault, Google Cloud KMS. Reduces risk of key leakage and cipher misconfiguration.
Cryptography as a Service Security Pattern
In this pattern, the management of cryptographic keys is delegated to the same entity that performs the cryptographic actions. Consequently, the system under design never possesses the used cryptographic keys.
Benefits and Trade-offs
Benefits:
Limits risk of leaking cryptographic keys
Reduces risk of incorrectly configuring and/or using a cipher
System only handles key identifiers, not key material
Trade-offs:
Requires greater trust in the entity providing cryptographic operations
Dependency on external service availability
Common Implementations
Type
Examples
Cloud-based KMS
Google Cloud KMS, Amazon KMS, Azure Key Vault
Mobile Platform
Android Keystore, iOS KeyChain
Hardware
Hardware Security Modules (HSM)
Core Components
Role
Type
Responsibility
System
Entity
Wants to perform cryptographic operations
Cryptography Service
Entity
Handles cryptographic operations, key storage, and key management
Note: The Cryptography Service inherits the Cryptographer role from the parent Cryptographic Key Management pattern.
keyId: Identifier returned by the service to reference the generated key
input: Plaintext input for cryptographic action
output: Result of cryptographic action (e.g., ciphertext, signature)
config: Configuration for the cryptographic operation (e.g., cipher mode) - optional
masterKey: Credential used to authenticate the System to the Cryptography Service
Actions
generate_key: Generate new cryptographic key according to configuration
crypto_action: Perform cryptographic operation using the identified key
Pattern Flow
Key Generation
System → [generate_key(keyConf)] → Cryptography Service
Cryptography Service → [keyId] → System
The System requests key generation with optional configuration. The Cryptography Service generates the key internally and returns only an identifier (not the key material) for future operations.
Cryptographic Action
System → [crypto_action(input, keyId, config)] → Cryptography Service
Cryptography Service → [output] → System
To use a previously generated key, the System provides the keyId received during generation. The key material never leaves the Cryptography Service.
Key Difference from Self-Managed Cryptography
Aspect
Cryptography as a Service
Self-Managed Cryptography
Key possession
System holds only key identifiers
System holds actual key material
Key storage
Managed by service
Managed by application
Key exposure risk
Lower (keys never exposed)
Higher (keys in application memory)
Trust requirement
Trust the service provider
Trust your own implementation
Security Considerations
The Cryptography Service as Uncontrolled Entity
The Cryptography Service should be considered an uncontrolled entity, requiring additional measures to secure interactions.
