Lab: lose the key and find out what that means

The CMEK lesson said the provider cannot help you if the key is lost, and that the fingerprint verifies rather than reconstructs. Those are load-bearing claims for a feature people enable to satisfy an auditor, so they are worth checking rather than accepting.

1. 1

   Model the split: the customer holds the key, the server holds ciphertext and a fingerprint.

   bash Copy

   cat > /tmp/cmek.py <<'EOF'
   import os, hashlib
   xor = lambda a, b: bytes(x ^ y for x, y in zip(a, b * (len(a)//len(b) + 1)))
   
   key = os.urandom(32)                       # never leaves the customer
   fingerprint = hashlib.sha256(key).hexdigest()
   blob = xor(b"sk-live-9f2a", key)           # encrypted before upload
   
   print("server stores fingerprint:", fingerprint[:16], "...")
   print("server stores ciphertext: ", blob.hex()[:24], "...")
   
   # the fingerprint can confirm a candidate key
   candidate = key
   print("\nfingerprint verifies a candidate:",
         hashlib.sha256(candidate).hexdigest() == fingerprint)
   
   # ... and cannot produce one
   del key, candidate
   try:
       print(xor(blob, key))
   except NameError:
       print("customer lost the key -> unrecoverable, by design")
   EOF
   python3 /tmp/cmek.py

2. 2

   The fingerprint did exactly one useful thing and could not do the other. Your fingerprint and ciphertext will differ from these, because the key is generated fresh on every run; the two lines that matter are the last two.

   text Copy

   server stores fingerprint: 6b16b6d49124d0b4 ...
   server stores ciphertext:  9923abb66f8a4e11c284ad76 ...
   
   fingerprint verifies a candidate: True
   customer lost the key -> unrecoverable, by design

3. 3

   Clean up.

   bash Copy

   rm /tmp/cmek.py

A SHA-256 of the key can confirm that a key you already have is the right one. It cannot run backwards, so it is a checksum rather than an escrow, and no amount of provider goodwill changes that.

• Verification is the fingerprint's whole job: it lets the server reject a wrong key before wasting a decryption attempt.
• There is no server-side copy by construction. That is the property being purchased, and its cost is that recovery is your problem.
• Server-assisted rotation decrypts with the old key first, so it is not a recovery path either. Losing the key means losing the ability to rotate as well as to read.