DEK
Data encryption key
The key that encrypts the data itself in envelope encryption, typically generated for each object, file or tenant and stored beside the data only in wrapped, that is encrypted, form.
- Also called
- data key
- Defined in
- NIST glossary: Data-encryption key
Covered in
Envelope encryption and key rotation: data keys, KMS keys and backups
Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.
Secrets at runtime: Vault, Kubernetes Secrets, CSI driver, External Secrets and SOPS
How a running workload should get its credentials: encrypt Kubernetes Secrets with a KMS v2 provider and lock down RBAC, mount from an external store with the Secrets Store CSI Driver, sync with External Secrets Operator, issue dynamic credentials with Vault and its Agent Injector, keep Git copies encrypted with SOPS, and make rotation reach the process.
Practice: Local project: Bind ciphertext to the correct record