The most important security consideration when implementing a system where cryptography is a security mechanism is preventing the exposure of the encryption keys. In this solution data encryption keys (symmetric) are protected with pubic (asymmetric) keys. The application does not perform any of the public key operations opting to instead use a private key security device through the Public Key Cryptography Standard number 11 API.

If this description already is taking a deep dive the solution to simply the complexity of PKI is to implement a profile concept as profiles are already widely used across apps and people have developed a familiarity. The profiles implemented here simply create a persistent link to the security device along with the preferred public key, in X.509 Certificate format.

Profile management is performing considerable amounts of overhead off-loading PKI management from the person creating or accessing data. As expected there would be a defect or required optimization discovered during field test. The Keys to the Kingdom update addresses deficiencies to all developers to continue to build data protection into the next up and coming features on the roadmap.