Store Asymmetric Key Container In Load Balanced Cloud Environment

Question

I've been tasked with signing some data with the C# RSACryptoServiceProvider.SignData() Method. In order to generate the public and private key i've used the RSACryptoServiceProvider and passed a keycontainername in order to store the keys safely.

When i run the MSDN example to generate a set of public/private keys on my machine with the fixed keycontainername, the expected public / private keys are generated every time the same.

This will work fine on a single server environment, however, we are operating on an elastic environment where the servers are load balanced. If i encrypt the data with a private key on any one single machine and store this data in through the RSACryptoServiceProvider the data will only exist at the machine level. Each machine will use a different key to sign the data and the user of the public key won't be able to verify the signature.

Is there any way i can store the key safely in a distributed environment?

Thanks

Answer 1

There are two that come to mind.

The first is use X509 certificates that contain the private key. You can use the X509Certificate2 class to get an RSACryptoServiceProvider instance that has the private key. The certificate and private key itself would be kept in the Windows certificate store. You can then limit access to the private key through the certificate store to certain accounts. You would then just install the certificate on each machine / AMI that needs it.

Your other option is to use an Hardware Security Module. AWS has a service called CloudHSM that allows you to use a network HSM inside of a VPC (I don't know how well that will work with Elastic Bean Stalk). The HSM vendor, SafeNet IIRC, allows installing a CSP that points to the HSM. You'd then give the RSACryptoServiceProvider a instance of CspParameters that accepts the container and CSP name.

The HSM solution is the most secure, albeit more complex and expensive.