Asymmetric keys are used to verify digital signatures or encrypt sensitive information between systems with different trust levels.

A public key and a private key are required for asymmetric encryption and decryption. The public key is available to all and the private key must be kept in strict confidence. These two are a pair of bidirectional keys in cryptography, that is, the public key and private key both can be used for encryption. If one is used for encryption, the decryption can only be performed using another key.

KMS supports popular asymmetric key algorithms and provides sufficient security strength to secure data encryption and digital signatures.

Supported Asymmetric Key Types

Algorithm	Key specifications	Protection Level
RSA	RSA_2048	· Software · HSM

Features

KMS does not support the automatic rotation of asymmetric CMKs due to the limits of public and private keys. You can create a key version in a specific CMK and generate a new pair of public and private keys.

The public key and private key of asymmetric keys are used for different purposes. The public key is used for data encryption and signature verification, and the private key is used for digital signature and decryption.

Feature	Description
Create a Key Version	· You can create a key version, but cannot configure an automatic rotation policy. · Asymmetric keys do not have a primary key version. Therefore, you must specify the corresponding CMK and a key version if you need to call the API related to asymmetric cryptographic operations.
Public Key Operations	· In most cases, you can call theGetPublicKeyAPI to obtain a public key and distribute it to users.Then, you can use cryptographic libraries such as OpenSSL and Java Cryptography Extension (JCE) to perform encryption and signature verification in your business systems. · You can also call theasymmetricEncryptorasymmetricVerifyAPI to perform public key operations for specific businesses.
Private Key Operations	· Due to the limits of private keys, you can call only theasymmetricSign or asymmetricDecrypt API to use a private key to decrypt data or generate a digital signature.

Application Scenarios of Asymmetric Keys

Scenario	Scenario
Signature verification	· Digital signature is a typical application of asymmetric encryption algorithm. Digital signature includes two processes: signature and verification. Specifically, the message sender uses the private key to sign the data, and the message receiver uses the public key to verify the signature. · The signature is unique as it is generated and encrypted with a private key. Digital signatures can be used for data tampering and identity authentication.
Data encryption or decryption	· The communication process of asymmetric key encryption is similar to symmetric encryption, but it needs a public key for data encryption and a private key for data decryption. · Ciphertext can be decrypted only with a private key, Therefore, even if information leakage occurs due to the low security of the transmission medium, those who get the ciphertext still cannot decrypt it, which ensures the security of sensitive information. It is suitable for transmitting sensitive information and is widely used in various key exchange scenarios.

Scenario

Signature verification

· Digital signature is a typical application of asymmetric encryption algorithm. Digital signature includes two processes: signature and verification. Specifically, the message sender uses the private key to sign the data, and the message receiver uses the public key to verify the signature.
· The signature is unique as it is generated and encrypted with a private key. Digital signatures can be used for data tampering and identity authentication.

Data encryption or decryption

· The communication process of asymmetric key encryption is similar to symmetric encryption, but it needs a public key for data encryption and a private key for data decryption.
· Ciphertext can be decrypted only with a private key, Therefore, even if information leakage occurs due to the low security of the transmission medium, those who get the ciphertext still cannot decrypt it, which ensures the security of sensitive information. It is suitable for transmitting sensitive information and is widely used in various key exchange scenarios.

Key Management Service