Protecting Encryption Keys with Azure Key Vault
summary
Shows how to use Azure Key Vault with HSM-backed keys to store RSA 2048 keys, sign/verify digests, and keep secrets up to 25KB while keeping private keys non-exportable. Demonstrates local key wrapping: generate AES-256 local keys, encrypt those keys with Key Vault RSA keys to cut HSM calls and improve throughput. Covers separate vaults per environment, key versioning and rotation, using Key Vault for HMAC-protected passwords, cost ballparks (≈$1/key, $0.03/10k ops) and .NET Core sample code on GitHub.
AI-written summary · about
chapters (14)
- 0:00Protecting Encryption Keys with Azure Key Vault
- 1:15The threat of data breaches Cryptography overview Key management options Introducing Azure Key Vault HSM Patterns and Practices
- 5:24Don't Just Focus on Perimeter Security
- 12:17Tamper proof Central key repository Can also store Certs (Private Keys)
- 16:46Once a key goes in the Key Vault, it never comes out again
- 18:08Keys vs Secrets
- 24:19Secrets are versioned in the key Vault
- 31:53Insurers Pll data encrypted using their own keys
- 34:44Key Versioning
- 36:29Password Protection
- 38:45Salted Hash Passwords
- 43:30Good practice to use different HMAC/ Vault Keys for different roles, it Admin, internal employee, customers etc.
- 47:28Digital Signing
- 53:14Data Breaches are Inevitable
related talks
56mProtecting Encryption Keys with Azure Key Vault
59mProtecting Encryption Keys with Azure Key Vault
01h 03mProtecting Encryption Keys with Azure Key Vault
47mManaging your Secrets in a Cloud Environment
10mCan you keep it a secret?
01h 01mCreate your own serverless PKI with .NET & Azure Key Vault
30mSecuring the Connected World - Detangling Encryption and Decryption
43mSecure Development