ZeroKMS by CipherStash is a key management system designed for the zero trust future. It is built to be used with CipherStash Proxy but can also be used with any database or application. ZeroKMS generates a unique key for every record in your database. Traditional solutions like AWS KMS perform one network round-trip per key request, making this level of granularity unrealistic. Composite keys manage decryption, ensuring no single entity can see the complete decryption key, and complete keys are never sent over the network. ZeroKMS enables fine-grained access control by generating a unique data-key per record. This level of granularity hasn’t previously been realistic because traditional solutions like AWS KMS perform one network round-trip per key request. ZeroKMS integrates with OpenID authentication providers such as Auth0, enabling per request identity checks. ZeroKMS guarantees that policy checks and audit logging always occur if decryption is successful. If any check or logging fails, the decryption also fails. Revoke keys immediately, without the need for re-encryption. ZeroKMS is built as a docker container, so it can be deployed anywhere. It never sees plaintext data; it generates and returns key seeds to the client to create the data key locally. This significantly reduces attack vectors. Data keys are never seen by third parties and are never sent across the network. ZeroKMS performs bulk encryption and decryption operations, allowing a data key to be generated for every record in your database without sacrificing performance. ZeroKMS uses composite keys to manage decryption, meaning no single entity can see the complete decryption key. Complete keys are never sent over the network. ZeroKMS guarantees that policy checks and audit logging always occur if decryption is successful. If any check or logging fails, the decryption also fails. Revoke keys immediately, without the need for re-encryption.
