Method and apparatus for managing cryptographic keys

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for managing keys, the method comprising:

• authenticating a client at a key manager;
• receiving a token from the client at the key manager, wherein the token is indicates whether the customer key upon being decrypted is to be returned to the client or used by the key manager and includes one half of an authenticator pair used to determine whether the client is the owner of the customer key;
• decrypting the token using a master key;
• verifying that the client is the owner of the customer key based at least on a client authenticator received from the client, wherein the client authenticator comprises the other half of the authenticator pair;
• and
• in response to the token indicates that the customer key upon being decrypted is to be returned to the client, sending the customer key to the client, thereby allow the client use the customer key to encrypt or decrypt data.

An apparatus for managing keys, comprising:

• a key manager;
• a client;
• a token;
• an authentication mechanism configured to authenticate the client;
• a receiving mechanism configured to receive a token from the client at the key manager, wherein the token indicates whether the customer key upon being decrypted is to be returned to the client or used by the key manager and includes one half of an authenticator pair used to determine whether the client is the owner of the customer key;
• a decrypting mechanism configured to decrypt the token using the master key;
• a verifying mechanism configured to verify that the client is the owner of the customer key based at least on a client authenticator received from the client, wherein the client authenticator comprises the other half of the authenticator pair;
• and
• a sending mechanism configured to send the customer key to the client to allow the client to use the customer key to encrypt or decrypt data and to delete the customer key after encryption or decryption if the token indicates that the customer key upon being decrypted is to be returned to the client.