HYOK (Hold Your Own Key) / External Key Store (XKS)

The Extreme End of the Spectrum

HYOK (Hold Your Own Key), now formally implemented in AWS as External Key Store (XKS) and in Google Cloud as Cloud EKM (External Key Manager), is the architecture for organizations that cannot trust the cloud provider under any circumstances. The defining characteristic: the cloud provider never sees the plaintext key. Ever.

The key lives in your physical data center, your co-location facility, or a third-party HSM service you control. The cloud provider's infrastructure reaches out to your key store for every cryptographic operation.

How It Actually Works

The mechanics are a fundamental inversion of BYOK:

1. You configure a cloud service (e.g., S3) to use an external key store.
2. You run an XKS Proxy — a small HTTPS service that sits in front of your on-premise HSM and speaks the AWS XKS API protocol.
3. When S3 needs to encrypt a file, it generates a random Data Encryption Key (DEK) locally, then sends the DEK to your XKS Proxy over the internet.
4. Your on-premise HSM encrypts the DEK using your master key and returns the encrypted DEK to AWS.
5. AWS stores the encrypted DEK alongside the ciphertext. The plaintext DEK is discarded.
6. To read the file, the process reverses: AWS sends the encrypted DEK to your HSM, your HSM decrypts it, returns the plaintext DEK, and AWS uses it to decrypt the file.

The critical guarantee: At no point does AWS possess your master key. If a government subpoenas AWS, AWS can hand over the ciphertext and the encrypted DEK — both are useless without your HSM. If you unplug your HSM or revoke the XKS Proxy's credentials, every read and write operation in the cloud fails immediately.

The Operational Cost

This architecture introduces a hard dependency between your cloud workload and your on-premise infrastructure:

• Latency: Every S3 read/write adds a network round-trip to your data center. For a high-throughput application, this can add 10–50ms per operation — catastrophic for databases or real-time systems.
• Availability coupling: If your internet connection drops, your on-premise HSM goes offline, or your XKS Proxy crashes, your cloud applications stop working. You have introduced a new single point of failure.

• Cost: Running and maintaining HSM hardware, the XKS Proxy, and the network infrastructure is expensive. AWS charges extra for XKS-backed KMS keys.

• Pros: Absolute cryptographic sovereignty. The cloud provider cannot comply with a decryption subpoena because they are technically incapable of decrypting the data.

• Cons: Significant latency per operation, availability risk tied to on-premise infrastructure, high operational complexity and cost.