Envelope encryption
Encrypting data with a local data key, then encrypting that data key under a master key held in a KMS or HSM.
In envelope encryption each object or record is encrypted with a fresh data encryption key (DEK). The DEK is then wrapped (encrypted) by a key encryption key (KEK) that never leaves the KMS or HSM. You store the wrapped DEK next to the ciphertext and throw the plaintext DEK away after use.
It exists because KMS calls are slow, rate limited and size limited, while bulk data needs local AES. It also makes rotation cheap: rotating the KEK means re-wrapping small DEKs, not re-encrypting terabytes. And it scopes blast radius, since each DEK covers one object.
Mistakes: caching plaintext DEKs for hours, reusing one DEK for everything (which reintroduces nonce limits), and not binding the wrapped DEK to its object via encryption context or associated data. Per-user DEKs also enable crypto-shredding.
aws kms generate-data-key --key-id alias/app-data --key-spec AES_256
# Returns Plaintext (use, then discard) and CiphertextBlob (store with the data)Learn it properly
Also used in
- AEAD and nonce disciplineSecEng · Applied cryptography engineeringFree
- Key rotation and crypto agilitySecEng · Applied cryptography engineeringFree
- Post-quantum migrationSecEng · Applied cryptography engineeringFree
- The round, the framework, the numbersHLD · The security HLD roundFree
- Design a secure file sharing serviceHLD · Design problems: communication securityFree
- Design a TOTP verifierLLD · Problems: crypto & protocol componentsFree
- Secrets management and rotationSecEng · Identity & Access EngineeringPro
- Multi-tenant isolationSecEng · Advanced: Security Architecture at ScalePro