Key Management in Windows Azure

Question

I\'m a bit confused about how to store keys (for data encryption) in Windows Azure.

According to the following two links (#1, #2), it is recommended to store the keys/ke

Answer 1

You'll see from my comment in that first link that I agree with your concerns. :)

Azure has no secure way of storing keys other than it's own Certificate Storage. Here is an article on using this method:

Field Note: Using Certificate-Based Encryption in Windows Azure Applications

You'll notice I've also commented on that article's shortcomings too, linking to this question:

Read azure ServiceConfiguration file's certificate section using c#

An example of using Azure's built in certificate storage to encrypt AES keys (avoiding the RSA restrictions on encrypted data length, while keeping the AES key secure) can be found in this project:

Codeplex: Azure Table Encryption via Attribute

The SymmetricKeyHelper class in the EncryptDecrypt project is of particular interest.

Kudos to @breischl for mentioning it, and for his contributions to the project.