Auth0 Security Questions Regarding Keys Used for Secret Encryption

This article answers common security questions regarding the keys used for secret encryption in Auth0. It provides details on the type, length, and mode of encryption keys, as well as information on key storage and master key specifications.

• Auth0
• Secret Encryption

What are the specifications and storage details for keys used in Auth0 secret encryption?

Review the following details regarding the encryption types, key lengths, modes, and storage locations used for secret encryption in Auth0.

• Auth0 encrypts data at-rest using Advanced Encryption Standard (AES) 256-bit encryption (AES-256). Auth0 encrypts data in-transit using Transport Layer Security (TLS) with versions 1.2 and higher allowed.
• Auth0 performs volume-level data encryption using AES-256 Galois/Counter Mode (AES-256-GCM) through Amazon Web Services (AWS) Elastic Block Store (EBS) encryption. Auth0 performs field-level data encryption using AES-256 Cipher Block Chaining (AES-256-CBC) with a symmetric key and Hash-based Message Authentication Code Secure Hash Algorithm 256 (HMAC-SHA-256).
• Tenant keys consist of a 2048-bit Rivest-Shamir-Adleman (RSA) key pair that is unique per tenant. Auth0 stores tenant signing keys and secrets encrypted in separate databases. Auth0 securely stores 2048-bit RSA asymmetric tenant signing key pairs using AES 256-bit encryption.
• Customer-sensitive data encryption keys and the Auth0 Secure Identity Platform service configuration and secrets leverage the AWS Parameter Store for storage. Auth0 encrypts each SecureString value using AES 256-bit symmetric encryption with customer master keys stored in an AWS Key Management Service (KMS).
• Administrators cannot export a symmetric customer key or the private portion of an asymmetric customer key from the KMS.
• Auth0 uses the bcrypt password hashing algorithm with a 128-bit salt and 10 rounds for password hashing.
• Auth0 secures Rules secrets using AES-256-CBC and HMAC-SHA-256. Auth0 secures Actions secrets using AES-256-GCM. Auth0 stores secrets related to Multi-Factor Authentication (MFA) using AES-256-GCM.
  • NOTE: Auth0 expects to change the field-level data encryption algorithm in the future from AES-256-CBC and HMAC-SHA-256 to AES-256-GCM.