This topic describes symmetric encryption, which is the most commonly used data encryption method. KMS provides easy-to-use API operations that allow you to encrypt and decrypt data on the cloud.

KMS supports popular symmetric key algorithms and provides high-level data security by using strong cryptography.

Supported Symmetric Key Types

Algorithm	Key Length	Key specifications	Protection Level
AES	256 bits	AES_256	· Software · HSM

Features of Symmetric Keys

Each symmetric CMK that is generated in KMS supports multiple key versions. KMS automatically rotates CMKs by generating new key versions. You can customize the key rotation policy. To meet special security compliance requirements, you can encrypt data with your own key (BYOK).

Feature	Description
Automatic key rotation	· You can configure the automatic rotation policy to generate a new key version, and automatically set it as the primary key version (primaryKeyVersion). KMSwill use the primary key version for encryption and decryption. · After a primary version is generated through key rotation, KMS does not delete or disable the non-primary version, which is used for decryption.
Import key materials (BYOK)	· By default, KMS will generate a key material when creating a CMK. You can also selectExternaland import your own key material to the CMK. · You can delete the imported key material, or set an expiration time to delete the key material after expiration (CMK will not be deleted). After you remove the imported key material, you can re-import the same key material to make the relevant CMK available again. Therefore, we recommend that you save a copy of the key material. · You can import only one key material for a CMK. When a key material is imported, CMK will be bound with the key material. Other key materials cannot be imported even if the imported key material has expired or been deleted. If you need to rotate the CMK of the key material, you can only create a new CMK and import the new key material.

Feature

Description

Automatic key rotation

· You can configure the automatic rotation policy to generate a new key version, and automatically set it as the primary key version (primaryKeyVersion). KMSwill use the primary key version for encryption and decryption.
· After a primary version is generated through key rotation, KMS does not delete or disable the non-primary version, which is used for decryption.

Import key materials (BYOK)

· By default, KMS will generate a key material when creating a CMK. You can also selectExternaland import your own key material to the CMK.
· You can delete the imported key material, or set an expiration time to delete the key material after expiration (CMK will not be deleted). After you remove the imported key material, you can re-import the same key material to make the relevant CMK available again. Therefore, we recommend that you save a copy of the key material.
· You can import only one key material for a CMK. When a key material is imported, CMK will be bound with the key material. Other key materials cannot be imported even if the imported key material has expired or been deleted. If you need to rotate the CMK of the key material, you can only create a new CMK and import the new key material.

Application Scenarios of Symmetric Keys

The symmetric keys generated by KMS support the following data encryption methods to meet the requirements of diverse data protection scenarios.

Scenario	Scenario
Online encryption	· Online encryption is suitable for protecting small-scale sensitive data (less than 6KB), such as keys, certificates, and configuration files. · The data of the user is sent to the KMS server over a secure channel. The KMS server encrypts or decrypts the data through the CMK and returns the result to the user over a secure channel.
Envelope Encryption	· Envelope encryption is applicable for high-performance encryption and decryption of massive data, such as large-scale and performance-sensitive local files. · KMS generates the DEK and returns the DEK plaintext and the DEK ciphertext encrypted by the specified CMK. You can use the DEK plaintext to encrypt and decrypt data locally. The DEK plaintext in memory is destroyed, and the DEK ciphertext and the encrypted files are flushed to disks for storage.

Scenario

Online encryption

· Online encryption is suitable for protecting small-scale sensitive data (less than 6KB), such as keys, certificates, and configuration files.
· The data of the user is sent to the KMS server over a secure channel. The KMS server encrypts or decrypts the data through the CMK and returns the result to the user over a secure channel.

Envelope Encryption

· Envelope encryption is applicable for high-performance encryption and decryption of massive data, such as large-scale and performance-sensitive local files.
· KMS generates the DEK and returns the DEK plaintext and the DEK ciphertext encrypted by the specified CMK. You can use the DEK plaintext to encrypt and decrypt data locally. The DEK plaintext in memory is destroyed, and the DEK ciphertext and the encrypted files are flushed to disks for storage.

Key Management Service

Symmetric Encryption Overview