Skip to content

Latest commit

 

History

History
90 lines (63 loc) · 4.69 KB

faq-encryption.md

File metadata and controls

90 lines (63 loc) · 4.69 KB
copyright lastupdated keywords subcollection content-type
years
2017, 2024
2024-05-06
faq, frequently asked questions, object storage, rclone, encryption, Cyberduck, key protect, FedRAMP, AES, SHA
cloud-object-storage
faq

{{site.data.keyword.attribute-definition-list}}

FAQ - Encryption

{: #faq-encryption}

Frequently asked questions can produce helpful answers and insight into best practices for working with {{site.data.keyword.cos_full}}. {: shortdesc}

What types of authentication can I use to access {{site.data.keyword.cos_full}}?

{: #faq-authenticate} {: faq}

You can use an OAuth 2 token or an HMAC key for authentication. The HMAC key can be used for S3-compatible tools such as rclone, Cyberduck, and others.

Also, see API Key vs HMAC.

Does {{site.data.keyword.cos_short}} provide encryption at rest and in motion?

{: #faq-encrypt-basics} {: faq}

Yes. Data at rest is encrypted with automatic provider-side Advanced Encryption Standard (AES) 256-bit encryption and the Secure Hash Algorithm (SHA)-256 hash. Data in motion is secured by using the built-in carrier grade Transport Layer Security/Secure Sockets Layer (TLS/SSL) or SNMPv3 with AES encryption.

If you want more control over encryption, you can make use of IBM Key Protect to manage generated or "bring your own" keying. For details, see Key-protect COS Integration.

Is there additional encryption processing if a customer wants to encrypt their data?

{: #faq-encrypt-add} {: faq}

Server-side encryption is always on for customer data. Compared to the hashing required in S3 authentication and the erasure coding, encryption is not a significant part of the processing cost of {{site.data.keyword.cos_short}}.

Does {{site.data.keyword.cos_short}} encrypt all data?

{: #faq-encrypt-all} {: faq}

Yes, {{site.data.keyword.cos_short}} encrypts all data.

How do I encrypt my data?

{: #troubleshooting-cos-encryption} {: faq}

  1. Go to the {{site.data.keyword.cos_full_notm}} documentation for managing encryption to research the encryption topic.
  2. Choose between {{site.data.keyword.keymanagementservicefull}} and {{site.data.keyword.hscrypto}} for your encryption needs.
  3. Remember that customer-provided keys are enforced on objects.
  4. Use IBM Key Protect or {{site.data.keyword.hscrypto}} to create, add, and manage keys, which you can then associate with your instance of {{site.data.keyword.cos_full_notm}}.
  5. Grant service authorization
    1. Open your IBM Cloud dashboard.
    2. From the menu bar, click Manage > Access.
    3. In the side navigation, click Authorizations.
    4. Click Create authorization.
    5. In the Source service menu, select Cloud Object Storage.
    6. In the Source service instance menu, select the service instance to authorize.
    7. In the Target service menu, select IBM Key Protect or {{site.data.keyword.hscrypto}}.
    8. In the Target service instance menu, select the service instance to authorize.
    9. Enable the Reader role.
    10. Click Authorize

Does {{site.data.keyword.cos_short}} have FIPS 140-2 compliance for the encryption algorithms?

{: #faq-encrypt-fips} {: faq}

Yes, the IBM COS Federal offering is approved for FedRAMP Moderate Security controls, which require a validated FIPS configuration. IBM COS Federal is certified at FIPS 140-2 level 1. For more information on COS Federal offering, contact us via our Federal site.

Is client-key encryption supported?

{: #faq-encrypt-client} {: faq}

Yes, client-key encryption is supported by using SSE-C, Key Protect, or HPCS.

Is encryption applied to a bucket by default?

{: #faq-default-enc} {: faq}

Yes, by default, all objects stored in {{site.data.keyword.cos_short}} are encrypted using randomly generated keys and an all-or-nothing-transform (AONT). You can get the encryption details using IBM Cloud UI/CLI. For details, see Cloud Storage Encryption.