Understanding Key Manager cryptography

Reviewed on May 23, 2025

Cryptographic primitives in Scaleway Key Manager

This page provides information on the core cryptographic mechanisms used by Key Manager. It explains how cryptographic keys are generated, managed, and used to encrypt data. Key Manager uses these mechanisms in compliance with the cryptographic guidelines issued by France's national cybersecurity agency, as outlined in the ANSSI-PA-079 recommendations, to ensure the confidentiality and integrity of customer data.

Random number generation

Key encryption key (KEK) generation

Scaleway Key Manager uses a Cryptographically Secure Pseudorandom Number Generator (CSPRNG) to generate both keying material for managed keys and cryptographically unique initialization vectors (IVs).

This CSPRNG is based on the ChaCha-based pseudorandom number generator provided by modern Linux kernels. It is seeded with high-entropy, unpredictable sources, such as:

Timing variations from hardware events
True Random Number Generators (TRNGs), including the RDSEED and RDRAND instructions available on AMD64 processors

Note

The section above is in compliance with ANSSI-PA-079 Recommendation R14 (PDF), which mandates the use of a cryptographically secure and appropriately seeded pseudorandom generator for key and IV material.

Important

The information above applies only to keys generated by Key Manager. If you import a key using the Bring Your Own Key (BYOK) mechanism, these safeguards are not applied to your key material.

Customer-provided KEKs (BYOK)

Scaleway Key Manager supports Bring Your Own Key (BYOK), allowing customers to import their own key material. In this model, Scaleway does not generate keys on behalf of the customer. Instead, the responsibility for generating strong key material lies with the user.

To protect against direct reuse, imported key material is not used directly. Instead, it is processed using the HKDF algorithm (HMAC-based Key Derivation Function) with SHA-256 as the hash algorithm, incorporating secure random bytes added as a salt value.

Symmetric encryption

Scaleway Key Manager uses AES-256-GCM (AES with a 256-bit key in Galois/Counter Mode) with authenticated associated data (AEAD) for encrypting and decrypting user payloads.

To reduce the risk of key overuse, plaintext payloads are limited to a maximum size of 64 KiB. A unique 96-bit initialization vector (IV) is generated using the CSPRNG described in the section above.

Note

The section above is in compliance with ANSSI-PA-079 Recommendations R1, R4, and R12 regarding the choice of secure, authenticated symmetric encryption (R1), key and IV uniqueness (R4), payload size limitations and proper use of AEAD modes (R12). Refer to the ANSSI-PA-079 recommendations documentation (PDF) for more details.

Important

While Key Manager internally uses AES-256-GCM, this does not restrict users to the same algorithm for their data encryption keys (DEKs).
We recommend using cryptographic libraries like Tink, which handle DEK management with robust and reviewed algorithms. Scaleway provides Tink integrations for Go and Python, which is the preferred integration method.

Asymmetric encryption

Asymmetric encryption is a fundamental type of cryptographic method used to secure data with a pair of keys: a public key and a private key.

The public key is used for encryption and can be shared openly, while the private key is used for decryption and must be kept secret. This design eliminates the need to share a single key securely, which is a challenge in symmetric encryption.

Asymmetric encryption is particularly well-suited for secure communication and authentication, such as encrypting emails or verifying digital signatures. However, it is slower than symmetric encryption. Algorithms like RSA and ECC are common examples of asymmetric encryption.

As of now, Key Manager supports the following asymmetric encryption algorithms:

RSA-OAEP-2048-SHA256: RSA encryption with 2048-bit key and OAEP padding using SHA-256.
RSA-OAEP-3072-SHA256: RSA encryption with 3072-bit key and OAEP padding using SHA-256. (recommended)
RSA-OAEP-4096-SHA256: RSA encryption with 4096-bit key and OAEP padding using SHA-256.

Still need help?

Create a support ticket