{"id":9842,"date":"2021-11-02T12:00:32","date_gmt":"2021-11-02T11:00:32","guid":{"rendered":"http:\/\/www.orbit.cz\/?post_type=encyklopedie-cloudu&p=9842"},"modified":"2025-09-03T10:01:24","modified_gmt":"2025-09-03T08:01:24","slug":"sifrovaci-klice-kam-s-nimi-a-jak-pracovat-s-aplikacnimi-tajnostmi-v-cloudu","status":"publish","type":"encyklopedie-cloudu","link":"http:\/\/4.184.192.234\/en\/encyklopedie-cloudu\/sifrovaci-klice-kam-s-nimi-a-jak-pracovat-s-aplikacnimi-tajnostmi-v-cloudu\/","title":{"rendered":"Encryption keys: where to put them and how to work with application secrets in the cloud?"},"content":{"rendered":"
\n
\"Encryption<\/figure>\n<\/div>\n\n\n

Encryption keys, application passwords or other secrets are the same as house keys. You don't want to lose them, they need to be safe, and they should be replaced from time to time. The days when the database password was directly part of the application code are thankfully gone. The typical trend is to store passwords securely outside the application. So today we'll take a detailed look at how to work with passwords or secrets in general in the cloud and what tools we can use.<\/strong><\/p>\n\n\n\n

What keys or secrets will we encounter?<\/h3>\n\n\n\n

Working with keys or other secrets can be divided into two basic areas: management encryption keys<\/strong> and the report application secrets<\/strong>. Neither of them should be underestimated.<\/p>\n\n\n\n

Encryption keys<\/h2>\n\n\n\n

Encryption keys are an essential component for data encryption. The generally recommended approach is encrypt data anytime, anywhere<\/strong>, however, in this article we will focus on data encryption in the cloud. First, let's divide it into encryption during transmission<\/strong> (data in transit) a encryption of stored data<\/strong> (data at rest).<\/p>\n\n\n

\n
\"Ubiquitous<\/a>
Ubiquitous Encryption (slideshare.net)<\/figcaption><\/figure>\n<\/div>\n\n\n

Data encryption during transmission<\/h3>\n\n\n\n

This method of encryption is typically implemented using technologies SSL\/TLS<\/em> or IPsec<\/em>. The aim of these technologies, or protocols, is to secure the data transmission itself. For simplicity, we can think of these protocols as a secure tunnel between devices. The data inside this tunnel is accessible to the individual end devices, but the outside world (e.g., the ISP's devices) cannot see into this tunnel. A typical representative encryption data in transit<\/em> is familiar to all of us https protocol<\/strong>.<\/p>\n\n\n\n

Encryption of stored data<\/h3>\n\n\n\n

In this area, which is more interesting for us in terms of cloud usage, two basic approaches are usually applied, namely <\/strong>client-side encryption and server-side encryption.<\/p>\n\n\n\n

Client-side encryption<\/strong><\/h4>\n\n\n\n

The implementation of client-side encryption is always individual, since (as the name implies) the client (typically the application) is responsible for encryption. The data is therefore encrypted by the application itself before being stored in the cloud<\/strong>.<\/p>\n\n\n\n

The implementation of client-side encryption is therefore always up to the developer of the application itself. Generally speaking, it provides higher confidence than server-side encryption (because we have complete control over the encryption), but on the other hand it also brings some potential problems - complicates and prolongs application development<\/strong> and in case of incorrect implementation, vice versa may reduce the level of security<\/strong>.<\/p>\n\n\n

\n
\"Application<\/a>
Encryption model (docs.microsoft.com)<\/figcaption><\/figure>\n<\/div>\n\n\n

Server-side encryption<\/strong><\/h4>\n\n\n\n

In the case of server-side encryption, encryption occurs within the data store (whether it is a virtual server, database, or other resource). From the application's point of view, nothing changes - the application works with unencrypted data and does not need to be interfered with in any way.<\/p>\n\n\n\n

What about the encryption keys?<\/h3>\n\n\n\n

In all cases, i.e. when using client-side encryption, server-side encryption, but also when encrypting in transit, it is necessary to use encryption keys (i.e. passwords or certificates). The following applies:<\/p>\n\n\n\n