BYOK and HYOK: where are the keys?

BYOK: you supply key material

Bring Your Own Key is often used for solutions where the customer creates key material and imports it into a supported service at the cloud provider. The customer may gain control over parts of the lifecycle while the key is used within the provider's environment.

BYOK therefore does not automatically mean that key material remains outside the cloud or that only the customer's own equipment can use it. Review how import, copies, rotation and deletion work in the chosen service.

HYOK and an external key service: a different form of separation

Hold Your Own Key is used for models where key material is held outside the cloud service concerned. A supported integration can allow the cloud service to request cryptographic operations from an external key service.

What is actually held externally varies. An external root or master key can be used alongside data keys in the cloud. Caches, permitted requests and data in use therefore need to be included in the assessment. Blocking an API request does not guarantee that all previous access immediately ends.

Compare the control, not just the acronym

• Location: where is each key and its backup copies held?
• Use: which operations take place with which party?
• Authorisation: who can approve use or change policy?
• Availability: what happens if the connection to the external service is interrupted?
• Exit: how are data and keys restored, moved or retired?

Client-side encryption is another model

With client-side encryption, content is encrypted before it is passed to the service concerned. This can distribute control differently, but also raises questions about clients, identity, collaboration and recovery. Choose a model based on the information's needs and the integrations actually supported.