I understand that we should keep our cryptographic keys using a key management service from another CSP than the CSP where our encrypted data rests.
Then, I read the following in the official online curriculum which I would like clarification on please:
“Both encrypted data and the key to decrypt it must be present at the same time and location (physical or logical) to use or modify the data.”
Well, since they are on different clouds, they cannot be physically present in the same location.
Then, logically, how do the key and the encrypted data meet up?
Are they both pulled by the application from separate providers at the same time, and brought together in a memory location on your host?
It is mind boggling. And I would like to better grasp and explore this topic.
