Skip to main content

Encrypt data with SSE-C

Server-side encryption with customer-provided keys (SSE-C) lets you encrypt objects with a key that only you hold. Use SSE-C for sensitive data or when security regulations require you to control the encryption keys.

How SSE-C works​

Upload: you send the encryption key together with the object. FPT Object Storage encrypts the data with that key, stores the encrypted data, and discards the key.

Download: you send the same key with the request. FPT Object Storage uses it to decrypt the data and returns the object.

Manage your keys​

FPT Object Storage does not store your encryption keys, so you are fully responsible for them.

  • Create, store, and protect each key yourself, with security procedures that fit your organization.
  • Keep track of which key encrypted which object. Every later download of the object needs the same key.
danger

If you lose an encryption key, the data encrypted with it cannot be recovered.

Use SSE-C from an SDK​

SSE-C is set per request through the S3 API, for example with an SDK or AWS CLI. Requests that use SSE-C must be sent over HTTPS.

The following Python example uploads and downloads an object with a 256-bit key:

import os
import boto3

s3 = boto3.client(
    "s3",
    endpoint_url="https://s3-hcm04.fptcloud.com",
    aws_access_key_id="YOUR_ACCESS_KEY",
    aws_secret_access_key="YOUR_SECRET_KEY",
)

key = os.urandom(32)  # store this key safely; it is required to read the object

s3.put_object(Bucket="YOUR_BUCKET", Key="secret.txt", Body=b"Hello",
              SSECustomerAlgorithm="AES256", SSECustomerKey=key)

obj = s3.get_object(Bucket="YOUR_BUCKET", Key="secret.txt",
                    SSECustomerAlgorithm="AES256", SSECustomerKey=key)
print(obj["Body"].read())

For connection settings in other languages, see SDK reference.