← Back to the reading view
Slides · 7 slides
BYOK and HYOK: who really controls your cloud encryption keys
The same use case told visually, ready to present. Speaker notes carry the full explanation.
Key Management
BYOK and HYOK
Every cloud encrypts by default. The question is who controls the key
Control moves step by step from the provider to you
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today1 / 7
BYOK
Generate the key yourself, then import it
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today2 / 7
Worked example
Sizing a hybrid import blob
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today3 / 7
BYOK
What BYOK buys, and what it doesn't
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today4 / 7
HYOK
The key never enters the cloud
Cut the link, and the provider can no longer decrypt: a kill switch
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today5 / 7
The costs
Holding the key yourself
HYOK protects keys, not data in use: the service still sees plaintext
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today6 / 7
Choosing
Match the control to the threat
Check the HSM's FIPS 140-3 level and which operations you can refuse
BYOK and HYOK: who really controls your cloud encryption keys · Classical Crypto Today7 / 7
1 / 7
Keys: ← → move, F full screen, G all slides, N notes