Skip to content

Commit 3fe09a6

Browse files
nerda-codesnerda-codes
committed
docs(key-manager): last tweaks
1 parent ff8fd64 commit 3fe09a6

11 files changed

+62
-57
lines changed

‎menu/navigation.json

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -632,7 +632,7 @@
632632
"slug": "create-manage-dek"
633633
},
634634
{
635-
"label": "Perform key rotation on Key Manager keys",
635+
"label": "Rotate Key Manager keys",
636636
"slug": "rotate-km-keys"
637637
},
638638
{
@@ -676,15 +676,15 @@
676676
"slug": "create-dek-api-cli"
677677
},
678678
{
679-
"label": "Setting up Tink",
679+
"label": "Setting up and configuring Tink",
680680
"slug": "configuring-tink"
681681
},
682682
{
683683
"label": "Managing your Key Manager keys using Tink",
684684
"slug": "manage-keys-with-tink"
685685
},
686686
{
687-
"label": "Perform key rotation using the Scaleway CLI and API",
687+
"label": "Rotate keys using the Scaleway CLI and API",
688688
"slug": "rotate-keys-api-cli"
689689
},
690690
{

‎pages/key-manager/api-cli/configuring-tink.mdx

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
---
22
meta:
3-
title: Configuring Tink
3+
title: Setting up and configuring Tink
44
description: Follow this guide to learn how to configure your environment and dependencies before using Tink in your projects.
55
content:
6-
h1: Configuring Tink
6+
h1: Setting up and configuring Tink
77
paragraph: Follow this guide to learn how to configure your environment and dependencies before using Tink in your projects.
88
tags: key-management dek data-encryption-key cli sdk api encryption
99
dates:
1010
validation: 2025-02-03
1111
posted: 2025-02-03
1212
---
1313

14-
This page shows you how to configure Tink for encrypting and decrypting data with Scaleway's Key Manager.
14+
This page shows you how to set up and configure Tink for encrypting and decrypting data with Scaleway's Key Manager.
1515

1616
We recommend using Tink with Scaleway’s Key Manager, especially for Go-based applications.
1717

@@ -48,9 +48,9 @@ Open a terminal and export the following environment variables. Make sure that y
4848

4949
1. Open a terminal and access your project directory:
5050

51-
```shell
52-
cd <your-project-directory>
53-
```
51+
```shell
52+
cd <your-project-directory>
53+
```
5454

5555
2. Initialize a Go module in your project directory:
5656
```shell
@@ -117,4 +117,4 @@ Scaleway supports the **Go Tink provider**.
117117
The `kekAEAD` object represents the key in Scaleway’s Key Manager. It allows you to encrypt payloads and decrypt ciphertexts.
118118
</Message>
119119

120-
Find out how to encrypt and decrypt data with Tink in the dedicated documentation.
120+
Find out how to encrypt and decrypt data with Tink in the [dedicated documentation](/key-manager/api-cli/encrypt-decrypt-data-with-km-dek/).

‎pages/key-manager/api-cli/encrypt-decrypt-data-with-km-dek.mdx

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -132,20 +132,21 @@ To encrypt your data using OpenSSl, you need to:
132132
133133
3. Encrypt the content of `plaintext.txt` using OpenSSL and the `AES-256-CBC` cipher encryption algorithm.
134134
135-
Open a terminal and paste the following command to perform the actions described above. Make sure that you replace `<kek_id>` and `<my_encrypted_data_key>` with the relevant values.
136-
```bash
137-
# Decrypt the encrypted DEK using scw key decrypt
138-
decrypted_data_key=$(scw keymanager key decrypt key-id=<kek_id> ciphertext=<my_encrypted_data_key> | awk '$1 == "Plaintext" {print $2}' | base64 -d)
135+
4. Open a terminal and paste the following command to perform the actions described above. Make sure that you replace `<kek_id>` and `<my_encrypted_data_key>` with the relevant values.
139136
140-
# Put your data plaintext into a .txt file
141-
echo -n "Your plaintext here" > plaintext.txt
137+
```bash
138+
# Decrypt the encrypted DEK using scw key decrypt
139+
decrypted_data_key=$(scw keymanager key decrypt key-id=<kek_id> ciphertext=<my_encrypted_data_key> | awk '$1 == "Plaintext" {print $2}' | base64 -d)
142140
143-
# Encrypt your file using OpenSSL and AES-256-CBC
144-
openssl enc -aes-256-cbc -in plaintext.txt -out encrypted.bin -K $(echo -n "$decrypted_data_key" | hexdump -ve '/1 "%02x"') -iv 0 -nosalt -p
141+
# Put your data plaintext into a .txt file
142+
echo -n "Your plaintext here" > plaintext.txt
145143
146-
# Remove the plaintext data
147-
rm plaintext.txt
148-
```
144+
# Encrypt your file using OpenSSL and AES-256-CBC
145+
openssl enc -aes-256-cbc -in plaintext.txt -out encrypted.bin -K $(echo -n "$decrypted_data_key" | hexdump -ve '/1 "%02x"') -iv 0 -nosalt -p
146+
147+
# Remove the plaintext data
148+
rm plaintext.txt
149+
```
149150
150151
### Decrypting data with OpenSSL
151152
@@ -155,14 +156,14 @@ To decrypt your encrypted data using OpenSSL, you need to:
155156
156157
2. Decrypt the content of `encrypted.bin` which contains your encrypted data, using OpenSSL and the `AES-256-CBC` cipher encryption algorithm.
157158
158-
Open a terminal and paste the following command to perform the actions described above. Make sure that you replace `<kek_id>` and `<my_encrypted_data_key>` with the relevant values.
159-
```bash
160-
# Decrypt the encrypted DEK using scw key decrypt
161-
decrypted_data_key=$(scw keymanager key decrypt key-id=<kek_id> ciphertext=<my_encrypted_data_key> | awk '$1 == "Plaintext" {print $2}' | base64 -d)
159+
3. Open a terminal and paste the following command to perform the actions described above. Make sure that you replace `<kek_id>` and `<my_encrypted_data_key>` with the relevant values.
160+
```bash
161+
# Decrypt the encrypted DEK using scw key decrypt
162+
decrypted_data_key=$(scw keymanager key decrypt key-id=<kek_id> ciphertext=<my_encrypted_data_key> | awk '$1 == "Plaintext" {print $2}' | base64 -d)
162163
163-
# Decrypt your data using OpenSSL and AES-256-CBC
164-
openssl enc -aes-256-cbc -d -in encrypted.bin -out decrypted.bin -K $(echo -n "$decrypted_data_key" | hexdump -ve '/1 "%02x"') -iv 0 -nosalt -p
165-
```
164+
# Decrypt your data using OpenSSL and AES-256-CBC
165+
openssl enc -aes-256-cbc -d -in encrypted.bin -out decrypted.bin -K $(echo -n "$decrypted_data_key" | hexdump -ve '/1 "%02x"') -iv 0 -nosalt -p
166+
```
166167
167168
<Message type="tip">
168169
If you do not wish to use OpenSSL to encrypt and decrypt your data encryption key, you can do it manually using the procedure below, which follows best practices.

‎pages/key-manager/api-cli/manage-keys-with-tink.mdx

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -25,22 +25,23 @@ This documentation page provides information on Key Manager Key Encryption Keys
2525

2626
## Encrypting and decrypting data with Tink
2727

28-
Paste the following code into a `.go` file. This template contains the data we will encrypt (`"Hello, World!"`), and the code to encrypt and decrypt it.
28+
Paste the following code into a `.go` file. This template contains an example of data we will encrypt (`"Hello, World!"`), and the code to encrypt and decrypt it.
29+
2930
```go
30-
associatedData := []byte("") // Read the ## Associated data section for more information
31-
secretData := []byte("Hello, World!") // Data we want to encrypt
31+
associatedData := []byte("") // Refer to the the ##Associated data section below for more information
32+
secretData := []byte("Hello, World!") // Defines secretData as the plaintext message ("Hello, World!") we want to encrypt
3233

33-
ciphertext, _ := kekAEAD.Encrypt(secretData, associatedData) // Encrypt the data
34-
fmt.Println(ciphertext) // Print the encrypted data
34+
ciphertext, _ := kekAEAD.Encrypt(secretData, associatedData) // Encrypts the data, the result is stored in ciphertext
35+
fmt.Println(ciphertext) // Prints the encrypted data ("Hello, World!" as unreadable bytes)
3536

36-
plaintext, _ := kekAEAD.Decrypt([]byte(ciphertext), associatedData)
37-
fmt.Println(string(plaintext)) // Output: "Hello, World!"
37+
plaintext, _ := kekAEAD.Decrypt([]byte(ciphertext), associatedData) // Decrypts the data, turning the ciphertext back into the original secretData
38+
fmt.Println(string(plaintext)) // Converts the decrypted unreadable bytes back to a string and prints "Hello, World!"
3839
```
3940

4041
<Message type="important">
4142
While the code shown above functions as intended, this is not a recommended pattern, and the following limitations apply:
4243
- It is slow: since the key resides on Scaleway Key Manager, each encryption or decryption operation translates into a remote API call.
43-
- The payload to encrypt is limited in size: Key Manager only allows up to 64 KiB. As a result, you will not be able to encrypt larger payloads with `kekAEAD`.
44+
- The payload to encrypt is limited in size: Key Manager only allows up to 64 KB. As a result, you will not be able to encrypt larger payloads with `kekAEAD`.
4445
- You cannot choose the cipher and the algorithm that suit your use case, Key Manager handles that on your behalf.
4546
</Message>
4647

‎pages/key-manager/api-cli/rotate-keys-api-cli.mdx

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
---
22
meta:
3-
title: Perform key rotation using the Scaleway CLI and API
4-
description: Learn why key rotation enhances security and how to configure automated or manual key rotation in Scaleway's Key Manager.
3+
title: Rotate keys using the Scaleway CLI and API
4+
description: Learn why key rotation enhances security and how to configure automated or manual key rotation in Scaleway's Key Manager.
55
content:
6-
h1: Perform key rotation using the Scaleway CLI and API
7-
paragraph: Learn why key rotation enhances security and how to configure automated or manual key rotation in Scaleway's Key Manager.
8-
tags: key sensitive-data rotation
6+
h1: Rotate keys using the Scaleway CLI and API
7+
paragraph: Learn why key rotation enhances security and how to configure automated or manual key rotation in Scaleway's Key Manager.
8+
tags: key sensitive-data rotation versioning
99
dates:
1010
validation: 2025-02-03
1111
posted: 2025-02-03
1212
---
1313

14-
Key rotation is a critical security practice that ensures that encryption keys are not reused for extended periods of time. Regularly rotating keys helps limit the number of messages encrypted with the same key version.
14+
[Key rotation](/key-manager/concepts/#key-rotation) is a critical security practice that ensures that encryption keys are not reused for extended periods of time. Regularly rotating keys helps limit the number of messages encrypted with the same key version.
1515

1616
This reduces the risk of exposure if a key is compromised, thus enhancing the overall security and resilience of your system. For symmetric encryption, it is generally recommended to rotate keys every 30 to 90 days.
1717

@@ -69,7 +69,7 @@ Copy the following command to configure automatic rotation when creating a key:
6969
- **rotation_period:** duration between two key rotations (min: 24 hours, max: 100 years).
7070
- **next_rotation_at:** date at which the key will be rotated next.
7171

72-
To configure automatic rotation on an existing key, use the `UpdateKey` endpoint as follows:
72+
To configure automatic rotation on an existing key, use the `UpdateKey` [endpoint](https://www.scaleway.com/en/developers/api/key-manager/#path-keys-update-a-key) as follows:
7373

7474
```
7575
curl -X PATCH 'https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/<your_key_id>' \
@@ -85,7 +85,7 @@ To configure automatic rotation on an existing key, use the `UpdateKey` endpoint
8585

8686
## Manually rotate your key
8787

88-
To rotate your key manually, you can use the `RotateKey` endpoint as follows:
88+
To rotate your key manually, you can use the `RotateKey` [endpoint](https://www.scaleway.com/en/developers/api/key-manager/#path-keys-rotate-a-key) as follows:
8989

9090
```
9191
curl -X POST 'https://api.scaleway.com/key-manager/v1alpha1/regions/fr-par/keys/<your_key_id>/rotate' \

‎pages/key-manager/concepts.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ A data encryption key is a type of key that can be used outside Key Manager to e
4545

4646
Key Manager generates DEKs on-demand. They are then encrypted by a [key encryption key](#key-encryption-key-kek) specified by the user, and forwarded to the recipient.
4747

48-
DEKs are **not stored in or managed by Key Manager**. Users are responsible for safely storing and managing DEKs. DEKs should have the same lifecycle as the [payload](#payload) they encrypt**.
48+
DEKs are **not stored in or managed by Key Manager**. Users are responsible for safely storing and managing DEKs. DEKs should have the same lifecycle as the [payload](#payload) they encrypt.
4949

5050
## Decryption
5151

5252
A cryptographic operation used to convert [ciphertext](#ciphertext) back into its original [plaintext](#plaintext) form, using a key encryption key.
5353

54-
The only way to decrypt an encrypted payload is by using the `Decrypt` [endpoint](https://www.scaleway.com/en/developers/api/key-manager/V1/#path-keys-decrypt-keys). Since key versions never leave Key Manager, there is no other way to decrypt data outside Key Manager.** A payload encrypted with an older key version can still be decrypted. In this case, for convenience, the payload encrypted with the latest key version will be returned, along with the decrypted payload.
54+
The only way to decrypt an encrypted payload is by using the `Decrypt` [endpoint](https://www.scaleway.com/en/developers/api/key-manager/V1/#path-keys-decrypt-data). Since key versions never leave Key Manager, there is no other way to decrypt data outside Key Manager. A payload encrypted with an older key version can still be decrypted. In this case, for convenience, the payload encrypted with the latest key version will be returned, along with the decrypted payload.
5555

5656
## Encryption
5757

‎pages/key-manager/how-to/create-manage-dek.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,5 +38,5 @@ You can then use your Key Manager key to encrypt your DEK.
3838
- Read our [documentation](/key-manager/reference-content/understanding-key-manager/) to understand Key Manager.
3939
</Message>
4040
6. Optionally, click **Display plaintext** to make sure that the plaintext does not contain any mistakes.
41-
<Macro id="key-manager-plaintext-vs-ciphertext" />
41+
<Macro id="key-manager-plaintext-vs-ciphertext" />
4242
7. Click **Close**.

‎pages/key-manager/how-to/retrieve-km-key-id.mdx

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,19 @@ content:
77
paragraph: Discover how to retrieve the ID of a Key Manager key from the Scaleway console to encrypt your data.
88
tags: key-manager key-id
99
dates:
10-
validation: 2025-02-03
11-
posted: 2025-02-03
10+
validation: 2025-02-06
11+
posted: 2025-02-06
1212
---
1313

1414
This page shows you how to retrieve the ID of your Key Manager key to encrypt data.
1515

1616
<Macro id="requirements" />
17+
- A Scaleway account logged into the [console](https://console.scaleway.com)
18+
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
19+
- [Created](/key-manager/how-to/create-km-key/) a Key Manager key
1720

1821
## How to retrieve the ID of a Key Manager key
1922

2023
1. Click **Key Manager** in the **Security and Identity section** of the [Scaleway console](https://console.scaleway.com) side menu.
2124
2. Click <Icon name="more" /> next to the key of which you wish to retrieve the ID. The key's **Overview** page displays.
22-
3. Click **Copy key ID**.
25+
3. Click **Copy key ID**. The ID of your key is copied.

‎pages/key-manager/how-to/rotate-kem-keys.mdx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
---
22
meta:
3-
title: Perform key rotation using the Scaleway console
3+
title: Rotate keys using the Scaleway console
44
description: Discover how to rotate a key from the Scaleway console to decrypt your data using Scaleway's Key Manager.
55
content:
6-
h1: Perform key rotation using the Scaleway console
6+
h1: Rotate keys using the Scaleway console
77
paragraph: Discover how to rotate a key from the Scaleway console to decrypt your data using Scaleway's Key Manager.
8-
tags: key-manager encryption data key
8+
tags: key-manager rotation key-version
99
dates:
1010
validation: 2025-02-03
1111
posted: 2025-02-03
@@ -21,7 +21,7 @@ This reduces the risk of exposure if a key is compromised, thus enhancing the ov
2121
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
2222
- [Created](/key-manager/how-to/create-km-key/) a Key Manager key
2323

24-
## How to perform key rotation
24+
## How to rotate keys
2525

2626
1. Click Key Manager in the **Security and Identity section** of the [Scaleway console](https://console.scaleway.com) side menu. Your keys display.
2727
2. Click the key you want to rotate. Your key's **Overview** tab displays.

‎pages/key-manager/reference-content/differences-key-and-secret-manager.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
---
22
meta:
3-
title: Understanding the difference between Key Manager and Secret Manager
3+
title: Differences between Key Manager and Secret Manager
44
description: Discover the differences between Secret Manager and Key Manager, and learn which security tool best fits your data protection needs.
55
content:
6-
h1: Understanding the difference between Key Manager and Secret Manager
6+
h1: Differences between Key Manager and Secret Manager
77
paragraph: Discover the differences between Secret Manager and Key Manager, and learn which security tool best fits your data protection needs.
88
tags: key-manager secret-manager security
99
dates:

0 commit comments

Comments
 (0)