SECURING FIBRE CHANNEL FABRICS - Brocade

Key ManagementBrocade Encryption DeviceLink key1Trusted linkKey VaultLink keyWrapped DEKwith keyencryption key6EncryptionengineEncryptionengineEncryptionengine2CleartextDEK3WrappedDEKSecure link4WrappedDEK5CleartextDEKKeyencryptionkeyFigure 7. Trusted key exchangeTo prevent key exchanges from being sniffed or intercepted duringtransmission between encryption devices and key vaults, most vendorsuse secure channels for the key exchange or wrap the key using asymmetric key before sending it over the channel. Many variations forthe key exchange process exist. For example, one vendor uses asecure channel (SSL) and wraps (encrypts) the key before sending itacross the secure channel.Opaque Key ExchangeWith opaque key managers, the key management application neverhas access to cleartext keys; the keys are always encrypted. One of theadvantages of the opaque key management solution is that it does notrequire a hardened chassis and can be implemented using a softwareonlysolution in a conventional server. Figure 34 illustrates the simplifiedopaque key exchange process.One of the primary distinctions between an opaque key exchange anda trusted one is that the DEK is wrapped prior to sending it to the keyvault, where it is stored as is. With a trusted key exchange, thewrapped key is unwrapped at the key vault and then re-wrapped usinga different key encryption key. An opaque key vault does not containinformation on how the DEK was initially encrypted.Securing Fibre Channel Fabrics 89