The missing piece of that puzzle is - who can access the key fragments? Some may say, that though DFC doesn't allow cloud providers to have access to the whole key, Akeyless itself has the ability to construct the key whenever it wishes, since it manages the key fragments infrastructure.
Well, they're basically right, but, they can also be completely wrong.
Since Akeyless DFC enables Akeyless to perform cryptographic operations WITHOUT EVER COMBINING the encryption key, one of the key fragments can actually be on the customer's environment, where Akeyless has no access. This means that Akeyless, as a service provider, won't be able to decrypt any data that is encrypted by our customers (who hold one of the key fragments). The reason is simple: we don't have access to your fragment.
Therefore, in order to enable Zero-Knowledge Encryption, all you need is your own Customer Fragment.
Updated about 1 year ago