Glossary

KEK

Key encryption key

A key used only to encrypt, or wrap, other keys such as data encryption keys; it usually stays inside a KMS or HSM, and rotating it means rewrapping the keys it protects, not re-encrypting the data.

Also called: wrapping key
Defined in: NIST glossary: Key-Encryption-Key (KEK)

Covered in

Guide

Envelope encryption and key rotation: data keys, KMS keys and backups

Encrypt each record with its own data key, wrap that key in a KMS or HSM key, and keep wrapping-key rotation, data re-encryption, key deletion and restored backups as separate, tested operations.

Practice: Local project: Bind ciphertext to the correct record