Key splitting

1. A non-transitory computer-readable medium having stored thereon machine readable instructions that when executed cause a first computing device to:

perform key splitting without using a homomorphic encryption technique, the key splitting comprising:

obtaining a master key;

obtaining a random mask;

obtaining a masked version of the master key by performing an operation on the master key and the random mask, the operation selected from among an exclusive or (XOR), a multiplication, or a division;

forwarding the masked version of the master key from the first computing device to a key manager computing device;

responsive to the forwarding of the masked version of the master key, receiving a new mask from the key manager computing device;

determining a data key based on an XOR of the new mask and the random mask; and

use, by a data processing instance in the first computing device, the data key in encrypting, decrypting, or authenticating data.

2. The non-transitory computer readable medium according to claim 1 , wherein the new mask is based on a random selection of another mask by the key manager computing device and the masked version of the master key.

3. The non-transitory computer readable medium according to claim 1 , further comprising machine readable instructions that when executed cause the first computing device to:

generate the data processing instance to utilize the data key to encrypt, decrypt, or authenticate the data.

4. The non-transitory computer readable medium according to claim 3 , wherein the machine readable instructions to generate the data processing instance comprise instructions to:

generate an ephemeral instantiation of the data processing instance to utilize the random mask and the data key to encrypt, decrypt, or authenticate the data; and

utilize another ephemeral instantiation of a data processing instance that utilizes another random mask and another data key to encrypt, decrypt, or authenticate further data.

5. The non-transitory computer readable medium according to claim 1 , wherein the data comprises a set of data objects, and wherein the machine readable instructions further comprise instructions that when executed cause the first computing device to:

use the data key to derive a plurality of data keys, wherein each data key of the plurality of data keys corresponds to a respective data object of the set of data objects.

6. A method comprising:

performing, by a first computing device comprising a hardware processor, key splitting without using a homomorphic encryption technique, the key splitting comprising:

receiving a master key;

receiving a random mask;

generating a masked version of the master key by performing an operation on the master key and the random mask, the operation selected from among an exclusive or (XOR), a multiplication, or a division;

forwarding, by the first computing device, the masked version of the master key to a key manager computing device;

receiving, by the first computing device, a new mask from the key manager computing device responsive to the forwarding of the masked version of the master key to the key manager computing device;

determining, by the first computing device, a data key based on an XOR of the new mask and the random mask; and

using, by the first computing device, the data key in encrypting, decrypting, or authenticating data.

7. The method according to claim 6 , wherein the data comprises a set of data objects, and wherein the method further comprises:

using, by the first computing device, the data key to derive a plurality of data keys, wherein each data key of the plurality of data keys corresponds to a respective data object of the set of data objects.

8. The method according to claim 6 , further comprising:

generating, by the first computing device, a data processing instance to utilize the data key to encrypt, decrypt, or authenticate the data.

9. The method according to claim 6 , wherein the data comprises an index, and wherein the new mask is related to the data key by the index of the data.

10. The non-transitory computer readable medium according to claim 1 , wherein the new mask is based on an XOR of a further randomly selected mask, the master key, and the random mask at the key manager computing device.

11. The non-transitory computer readable medium according to claim 10 , wherein the further randomly selected mask is randomly selected by the key manager computing device.

12. The method according to claim 6 , wherein the new mask is based on an XOR of a further randomly selected mask, the master key, and the random mask.

13. The method according to claim 12 , wherein the further randomly selected mask is randomly selected by the key manager computing device.

14. A first computing device comprising:

a processor; and

a non-transitory computer-readable storage medium storing instructions executable on the processor to:

perform key splitting without using a homomorphic encryption technique, the key splitting comprising:

obtaining a master key;

obtaining a random mask;

generating a masked version of the master key by performing an exclusive or (XOR) on the master key and the random mask;

forwarding the masked version of the master key to a key manager computing device;

receiving a new mask from the key manager computing device responsive to the forwarding of the masked version of the master key;

determining a data key based on an XOR of the new mask and the random mask; and

use, by a data processing instance, the data key in encrypting, decrypting, or authenticating data.

15. The first computing device according to claim 14 , wherein the new mask is based on an XOR of a further randomly selected mask, the master key, and the random mask.

16. The first computing device according to claim 15 , wherein the further randomly selected mask is randomly selected by the key manager computing device.

17. The first computing device according to claim 14 , wherein the instructions are executable on the processor to generate the data processing instance.

18. The first computing device according to claim 17 , wherein the generated data processing instance is an ephemeral data processing instance.