Table of contents
What are customer-managed keys?
Customer-managed keys are encryption keys that the data owner creates, stores, rotates and controls in its own key management service, instead of leaving them with the storage or cloud provider. The provider still encrypts the data, but cannot read it unless the owner's key service releases the key.
How do provider-managed and customer-managed keys differ?
| Provider-managed keys | Customer-managed keys | |
|---|---|---|
| Who creates and stores the key | The provider | The data owner, in its own key service |
| Protects against a stolen drive | Yes | Yes |
| Protects against provider staff or a stolen provider login | No | Yes, if the key is held outside the provider |
| Who can make data unreadable at will | The provider | The owner, by revoking access |
| Who carries key-loss risk | The provider | The owner |
Withdrawing the platform's access to the key leaves the data in place but unreadable to everyone, the provider included. That property is why customer-managed keys appear in data sovereignty requirements.
How does a key request work?
Most designs use two layers, known as envelope encryption. Each object or volume is encrypted with its own data key, and each data key is wrapped, meaning encrypted, by a master key that never leaves the owner's key manager. The storage keeps only wrapped data keys. To read an object it sends the wrapped key to the key manager, which checks the request and returns the unwrapped key for that operation. Many key managers use the open KMIP protocol for these requests, and the master key often lives in a hardware security module.
The layering also makes rotation quick. A new master key means re-wrapping the small data keys, not re-encrypting every stored object.
What risks move to the key owner?
- Key loss. Losing the master key is the same as deleting all data encrypted under it, and the provider cannot help.
- Accidental deletion. Cloud key services commonly impose a waiting period before a deleted key is destroyed. A key manager without that delay turns a mistaken delete into immediate data loss.
- Single custodian. Quorum approval, where several named people agree before a master key is exported or destroyed, stops one administrator from becoming the new single point of risk.
- Availability. If the key manager is down, reads fail, so the key service needs the same resilience as the storage it serves.
Where do keys sit in recovery order?
Backup encryption with keys held away from the backup system limits what a stolen repository yields. In a full rebuild, though, the key manager has to come back before any encrypted backup can be read, so its recovery path is part of restore testing.
Frequently asked questions
What is the difference between customer-managed keys and BYOK?
BYOK usually means the owner generates a key and imports it into the provider's key service, which the provider still operates. Customer-managed keys can also mean the key stays in a manager the owner runs. Providers use the terms inconsistently, so contracts state where the key material lives.
Do customer-managed keys protect against a legal demand on the provider?
Only if the provider cannot reach the key. A key in the provider's own key service can still be used under compulsion, while a key held externally under the owner's jurisdiction cannot.
Can data be recovered after a customer-managed key is lost?
No. The ciphertext remains but nothing decrypts it. Destroying a key on purpose to make data unrecoverable is called crypto-shredding.
Related terms
- Hardware security module: the device that often protects the master key.
- Backup encryption: where key custody decides whether backups can be read.
- Data sovereignty: the legal reason many owners keep their own keys.
- Data exfiltration: theft that unreadable ciphertext blunts.
- Restore testing: proof that the key recovery path works.