Envelope Encryption
- AWS KMS and Google Cloud KMS use a method called envelope encryption to protect the data.
- Envelope encryption is an optimized method for encrypting data that uses two different keys (Master key and Data key)
- Master key is also known as Key Encryption Key – KEK and Data key is also known as Data Encryption Key – DEK.
- Envelope encryption reduces the network load for the application or the cloud service as only the request and fulfillment of the much smaller data key through KMS must go over the network.
- The data key is used locally by the encrypting service, avoiding the need to send the entire block of data to KMS and suffer network latency.
Root Key
- A root key is an encryption key that is used to encrypt other encryption keys, such as data keys and key encryption keys. Unlike data keys and key encryption keys, root keys must be kept in plaintext so they can be used to decrypt the keys that they encrypted.
- Key Management Service (KMS) generates and protects the root keys.
Key Encryption Key – KEK
- A key encryption key is an encryption key that is used to encrypt a data key or another key encryption key. To protect the
- Key encryption key is encrypted by using a root key.
Data Encryption Key – DEK
- A data key or data encryption key is an encryption key that is used to protect data.
- Data keys differ from root keys and key encryption keys, which are typically used to encrypt other encryption keys.
Envelop Encryption Process
- Encryption
- Create a Master Key
- Generate data key.
- KMS returns the plaintext and ciphertext of the data key.
- The plaintext data key is used to encrypt each piece of data or resource.
- The data key is encrypted under a master key defined in KMS.
- The encrypted data key and encrypted data are then stored by the service.
- Decryption
- Retrieve the ciphertext data key and encrypted files from the persistent storage device or service.
- Decrypt the ciphertext data key using the Master key. The plaintext data key is returned.
- Use the plaintext data key to decrypt the files.
- Encrypting the data key is more efficient than reencrypting the data under the new key because it is quicker and produces a much smaller ciphertext.
Envelope Encryption Benefits
- Protecting data keys
- When you encrypt a data key, you don’t have to worry about storing the encrypted data key, because the data key is inherently protected by encryption. You can safely store the encrypted data key alongside the encrypted data.
- Encrypting the same data under multiple keys
- Encryption operations can be time-consuming, particularly when the data being encrypted are large objects.
- Instead of re-encrypting raw data multiple times with different keys, you can re-encrypt only the data keys that protect the raw data.
- Combining the strengths of multiple algorithms
- In general, symmetric key algorithms are faster and produce smaller ciphertexts than public key algorithms.
- But public key algorithms provide inherent separation of roles and easier key management.
- Envelope encryption lets you combine the strengths of each strategy.
