Software Securityhome
Fix a findingSearch
Glossary

Envelope encryption

Encrypting data with a data encryption key (DEK) and then encrypting, or wrapping, that DEK with a key encryption key (KEK) held in a KMS or HSM. Only the wrapped DEK is stored with the data, so the KEK never leaves its service, and rotating it means rewrapping DEKs rather than re-encrypting all the data.

Covered in

Guide

Envelope encryption and key rotation: data keys, KMS keys and backups

Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.

Practice: Local project: Bind ciphertext to the correct record

Find your next answer

Type to search. Search runs in your browser.

Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.