Highly-available cryptographic keys
Systems and methods for providing encrypted cryptographic keys. A system obtains a request to generate a data key. The system generates the data key and a data structure comprising the data key encrypted with keys from a set of compute regions. The system provides the data structure and the data key in response to the request. The data structure can be used to obtain the data key contingent on at least one compute region of the set of compute regions being available.
1. A computer-implemented method, comprising:
obtaining an application programming interface request to generate a data key, the application programming interface request indicating:
a set of compute regions, at least one compute region in the set of compute regions indicating a geographic location or region; and
a set of compute region preferences;
generating the data key;
submitting requests to the set of compute regions to encrypt the data key;
obtaining, in response to the requests, a set of encrypted data keys that are encrypted using corresponding managed keys of the set of compute regions;
generating a data structure comprising:
the set of compute region preferences;
the set of encrypted data keys; and
a set of bindings that map encrypted data keys of the set of encrypted data keys to corresponding compute regions of the set of compute regions; and
providing a response to the application programming interface request that comprises at least the data structure.
2. The computer-implemented method of claim 1 , the application programming interface request is a web service application programming interface request encoding parameters for:
a set of cryptographic key identifiers for the managed keys of the set of compute regions;
the set of compute regions;
the set of compute region preferences; and
configuration information for generating the data key.
3. The computer-implemented method of claim 1 , further comprising:
obtaining a second application programming interface request to decrypt the data key, the second application programming interface request comprising the data structure;
inspecting the data structure to determine a first encrypted data key of the set of encrypted data keys corresponding to a managed key;
decrypting the first encrypted data key using the managed key to determine a plaintext of the data key; and
providing a second response to the second application programming interface request that comprises the plaintext of the data key.
4. The computer-implemented method of claim 1 , wherein:
the application programming interface request further comprises a set of cryptographic key identifiers that identify the corresponding managed keys; and
the requests to the set of compute regions to encrypt the data key comprise at least the set of cryptographic key identifiers.
5. A system, comprising:
one or more processors; and
memory that stores computer-executable instructions that are executable by the one or more processors to cause the system to:
obtain a request to perform a cryptographic operation, wherein the request comprises an encrypted cryptographic key data structure, and further wherein the encrypted cryptographic key data structure comprises:
a plurality of encrypted cryptographic keys;
identifiers for a plurality of compute regions corresponding to the plurality of encrypted cryptographic keys, at least one of the plurality of compute regions indicating a geographic location or region; and
preferences indicating how to determine which compute region of the plurality of compute regions to use to perform cryptographic operations;
select a compute region of the plurality of compute regions based at least in part on the preferences and the selected compute region being available; and
provide at least an encrypted cryptographic key to the selected compute region to perform the cryptographic operation, wherein the encrypted cryptographic key is from the plurality of encrypted cryptographic keys and is associated with the selected compute region.
6. The system of claim 5 , wherein the preferences indicate an order of compute regions of the plurality of compute regions to use to perform the cryptographic operations.
7. The system of claim 5 , wherein the instructions to provide at least the encrypted cryptographic key to the selected compute region to perform the cryptographic operation further include instructions that, as a result of execution by the one or more processors, cause the system to provide the encrypted cryptographic key data structure to the selected compute region.
8. The system of claim 5 , wherein the request to perform the cryptographic operation is a request to obtain a plaintext cryptographic key, further wherein the plurality of encrypted cryptographic keys are different ciphertexts of the plaintext cryptographic key.
9. The system of claim 5 , wherein the instructions to select the compute region of the plurality of compute regions include instructions that, as a result of execution by the one or more processors, cause the system to determine availability of compute regions of the plurality of compute regions by at least:
transmitting a plurality of messages to the compute regions of the plurality of compute regions; and
determining the availability of the compute regions based at least in part on responses to the plurality of messages.
10. The system of claim 5 , wherein the instructions further include instructions that, as a result of execution by the one or more processors, cause the system to:
generate a second request based at least in part on the request, wherein the second request includes an identifier of a managed key from the selected compute region and the encrypted cryptographic key; and
submit the second request to a cryptography service instance of the selected compute region to cause the cryptography service instance to decrypt the encrypted cryptographic key using the managed key from the selected compute region.
11. The system of claim 10 , wherein the encrypted cryptographic key is encrypted with the managed key from the selected compute region.
12. The system of claim 5 , wherein the encrypted cryptographic key is provided to a cryptography service instance of the selected compute region.
13. A non-transitory computer-readable storage medium storing thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to:
submit an application programming interface request to generate a cryptographic key, the application programming interface request comprising:
a set of compute regions, at least one compute region in the set of compute regions indicating a geographic location or region; and
a set of preferences;
obtain a response to the application programming interface request that comprises the cryptographic key and a data structure encoding:
the set of preferences;
a set of encrypted data keys; and
a set of bindings that map encrypted data keys of the set of encrypted data keys to corresponding compute regions of the set of compute regions, at least one binding in the set of bindings including information usable to determine an availability of the at least one compute region in the set of compute regions; and
wherein the data structure is usable, by the computer system, to submit cryptographic requests that can be fulfilled contingent upon at least one of the set of compute regions being available.
14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to:
submit a second application programming interface request comprising the data structure; and
obtain, from a region of the set of compute regions, a second response to the second application programming interface request comprising a plaintext data key.
15. The non-transitory computer-readable storage medium of claim 13 , wherein the set of preferences comprise one or more criteria that determine which compute region of the set of compute regions to use to perform cryptographic operations.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the one or more criteria comprise at least one of:
geographical requirements;
latency requirements; or
security requirements.
17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors of the computer system, cause the computer system to:
submit a second application programming interface request to update the cryptographic key, the second application programming interface request comprising:
an updated set of preferences;
an updated set of compute regions; and
the data structure; and
obtain a second response to the second application programming interface request comprising an updated data structure, the updated data structure comprising:
the updated set of preferences;
an updated set of encrypted data keys; and
an updated set of bindings that map encrypted data keys of the updated set of encrypted data keys to corresponding compute regions of the updated set of compute regions.
18. The non-transitory computer-readable storage medium of claim 13 , wherein the application programming interface request further comprises an indication of a length of the cryptographic key.
19. The non-transitory computer-readable storage medium of claim 13 , wherein the cryptographic requests include requests to obtain the cryptographic key, in plaintext form, from the data structure.
20. The non-transitory computer-readable storage medium of claim 13 , wherein the data structure is an opaque data structure.