Securely encrypting data using a remote key management service

1. A method comprising:

transmitting a local secret to a remote key management service, wherein the local secret is stored in a portion of a storage device that is readable prior to obtaining a key-encrypting key;

generating the key-encrypting key by transforming a response received from the remote key management service, wherein the response received from the remote key management service is an encryption key that is a one-way cryptographic hash using, as input, the local secret transmitted to the remote key management service and wherein the encryption key received from the remote key management service is transformed using a cryptographic technique based on the local secret into the key-encrypting key; and

decrypting, based on the key-encrypting key, a local data encryption key for encrypting or decrypting local data.

2. The method of claim 1 , further comprising:

after transmitting the local secret to the key management service, receiving, from the key management service, the encryption key based on the local secret.

3. The method of claim 2 , wherein encrypting the local data further comprises:

transforming the encryption key from the key management service into the key-encrypting key.

4. The method of claim 3 , further comprising:

decrypting, based on the key-encrypting key derived from transforming the encryption key from the key management service, the data encryption key used to encrypt and decrypt the local data.

5. The method of claim 4 , further comprising:

decrypting, based on the data encryption key, the local data.

6. The method of claim 1 , further comprising:

transforming the local secret to generate a transformed local secret, including generating, based on a cryptographic hash function using the local secret, the transformed local secret, wherein:

transmitting the local secret to a key management service includes transmitting the transformed local secret to the key management service, and the one-way cryptographic hash uses, as input, the transformed local secret.

7. The method of claim 6 , wherein the cryptographic hash function is used by a hash-based message authentication code protocol.

8. The method of claim 1 , further comprising:

reconstructing the local secret based on multiple portions of the local secret distributed among a plurality of storage devices.

9. The method of claim 1 , further comprising:

transmitting a subsequent local secret in response to an occurrence of an event;

transforming a subsequent encryption key received from the key management service to generate a subsequent key-encrypting key; and

decrypting, based on the subsequent key-encrypting key, the local data encryption key for encrypting or decrypting local data.

10. An apparatus comprising a computer processor, a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

transmitting a local secret to a remote key management service, wherein the local secret is stored in a portion of a storage device that is readable prior to obtaining a key-encrypting key;

generating the key-encrypting key by transforming a response received from the remote key management service, wherein the response received from the remote key management service is an encryption key that is a one-way cryptographic hash using, as input, the local secret transmitted to the remote key management service and wherein the encryption key received from the remote key management service is transformed using a cryptographic technique based on the local secret into the key-encrypting key; and

decrypting, based on the key-encrypting key, a local data encryption key for encrypting or decrypting local data.

11. The apparatus of claim 10 , further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

after transmitting the local secret to the key management service, receiving, from the key management service, the encryption key based on the local secret.

12. The apparatus of claim 11 , wherein encrypting the local data further comprises:

transforming the encryption key from the key management service into the key-encrypting key.

13. The apparatus of claim 12 , further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

decrypting, based on the key-encrypting key derived from transforming the encryption key from the key management service, the data encryption key used to encrypt and decrypt the local data.

14. The apparatus of claim 13 , further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

decrypting, based on the data encryption key, the local data.

15. The apparatus of claim 10 , further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to carry out the steps of:

transforming the local secret to generate a transformed local secret, including generating, based on a cryptographic hash function using the local secret, the transformed local secret, wherein:

transmitting the local secret to a key management service includes transmitting the transformed local secret to the key management service, and the one-way cryptographic hash uses, as input, the transformed local secret.

16. The apparatus of claim 15 , wherein the cryptographic hash function is used by a hash-based message authentication code protocol.