Your organization has an internet-facing application behind a load balancer. Your regulators require end-to-end encryption of user login credentials. You must implement this requirement. What should you do?
A.
Generate a symmetric key with Cloud KMS. Encrypt client-side user credentials by using the symmetric key.
B.
Concatenate the credential with a timestamp. Submit the timestamp and hashed value of credentials to the network.
C.
Deploy the TLS certificate at Google Cloud Global HTTPs Load Balancer, and submit the user credentials through HTTPs.
D.
Generate an asymmetric key with Cloud KMS. Encrypt client-side user credentials using the public key.
Option C provides encryption in transit, but it's not truly end-to-end because the load balancer must decrypt the traffic to inspect it. Option D is correct because it encrypts the credential data itself on the client, ensuring only the final backend server can ever read the plaintext, which meets the strict requirement.
D. is the best solution for achieving true end-to-end encryption of the credentials. This method, known as asymmetric or public-key cryptography, ensures the data is encrypted on the client-side using a public key and can only be decrypted on the server-side by the corresponding private key, protecting the credential data throughout its entire transit.
Initially I was with D however it then didn't seem very scalable option. I believe this is now Answer C. The load balancer would decrypt the connection to inspect the packets at L7 but would re-encrypt it (SSL bridging) for full end to end encryption.
https://cloud.google.com/docs/security/encryption-in-transit#transport_layer_security
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
f983100
3 days, 1 hour agon2183712847
3 months, 1 week agon2183712847
3 months, 1 week agozanhsieh
11 months, 2 weeks agoMoAk
1 year agof36bdb5
1 year agoMoAk
1 year agojmaquino
1 year agoyokoyan
1 year, 2 months ago