Your company decides to start the business of selling toys online and shipping globally. A team in-house is in charge of developing an E-Commerce system that supports the new business. The development team encrypts the database connection string used in the application server cluster as it contains credentials, and stores the cyphertext in the configuration file using AES. The development team shall use the trusted platform module (TPM) on each application server to protect the AES cryptographic key without platform measurement. Which of the following is the best solution?
A. Key Signing
B. Key Binding
C. Key Sealing
D. Key Clustering
Kindly be reminded that the suggested answer is for your reference only. It doesn’t matter whether you have the right or wrong answer. What really matters is your reasoning process and justifications.
My suggested answer is B. Key Binding.
Binding vs. Sealing
Computers can create a key and encrypt it so that it can only be decrypted by the TPM, a microchip designed to provide essential security-related functions that primarily involve encryption keys. This process is often called wrapping or binding a key, which can help protect the key from disclosure.
Computers can also create a key, not only wrapped but also tied to certain platform measurements sot that it can be unwrapped only when those platform measurements have the same values that they had when the key was created. This process is referred to as “sealing the key to the TPM.” Decrypting the key is called unsealing.
The TPM can also seal and unseal data that is generated outside the TPM. With this sealed key and software, such as BitLocker Drive Encryption, you can lock data until specific hardware or software conditions are met.
Source: TPM fundamentals
Key clustering is an instance in which two different keys generate the same ciphertext from the same plaintext.
Source: Harris, Shon. CISSP All-in-One Exam Guide, Seventh Edition (p. 458). McGraw-Hill Education. Kindle Edition.
Keysigning refers to digitally signing someone else’s public key using your own. A more correct term would be certificate signing, since the actual key material is not changed by the process of signing.
Source: Key Signing