KMS provides lifecycle management of keys, and supports data encryption and decryption and digital signature verification based on the API.

Key Types Supported by KMS

The following table shows KMS's support for encryption algorithms, protection levels and application scenarios.

Cryptographic Algorithm Category	Cryptographic Algorithm Sub-category	Protection Level	Whether Encryption or Decryption Is Supported	Whether Signature Verification Is Supported
Symmetric key	AES_256	Software HSM	Support	Not supported
Asymmetric key	RSA_2048	Software HSM	Support	Support

Symmetric keys are mainly used for data encryption scenarios, and support online encryption or envelope encryption through APIs. For more information, seeSymmetric Encryption Overview.
Asymmetric keys can be used for data encryption and digital signature. You can create an asymmetric CMK in KMS, which consists of an associated public key and a private key. The public key can be distributed to all, while the private key is secured by KMS, where no API is available for exporting the private key of asymmetric keys. You can only perform signature operations or data decryption by calling the private key through the API. For more information, see Asymmetric Encryption Overview.

Key Lifecycle Management

KMS centrally manages key lifecycle so that you can easily create and use keys.

Feature	Description	Reference Documentation
Key Lifecycle Management	KMS allows you to create a CMK, as well as enable, disable, and delete the CMK. KMS supports key protection at the software or hardware level, and the hardware key is protected by the Hardware Security Module (HSM)to meet higher security requirements. You can import your own key materials into KMS, namely BYOK, to meet specific security requirements.	Create a Key Import a Key Material Enable/Disable a Key Scheduled Key Deletion
Key Edition Management	You can enhance the security of keys through key versioning or regular rotation to realize the security policy of data protection.	Key Edition Management
Key alias management	You can set a key alias to facilitate key use.	Alias Management

Cryptographic operation

KMS provides a cloud-native cryptographic operation API to meet diverse requirements such as data encryption and decryption, and digital signature verification.

Feature	Description	Reference Documentation
Symmetric key operation	Online encryption: suitable for encrypting a small amount of information (6KB), and directly encrypts and decrypts the data through the CMK.	Online encryption
	Envelope encryption: suitable for high-performance encryption of massive data. By generating the DEK, the data is encrypted and decrypted symmetrically and locally.	Envelope Encryption
Asymmetric key operation	Signature verification: suitable for transmitting sensitive information. The information sender provides identification by sending the signature and data, and the information receiver verifies the signature to check the security of the data.	Signature verification
	Asymmetric key encryption and decryption: suitable for transmitting sensitive information after encryption, and encrypting data by using the public key of the asymmetric key and decrypting data by using the private key.	Asymmetric Key Encryption and Decryption

Key Management Service

Key Management Overview