Protecting local key generation using a remote key management service, including: transforming a local secret to generate a transformed local secret; transmitting the transformed local secret to a key management service; and decrypting, based on an encryption key received from the key management service, a data encryption key for encrypting or decrypting local data.