Envelope encryption
Envelope encryption separates the data key from the key protecting it. The encrypted file and wrapped data key need to be managed together.
Protect data and its key separately
Envelope encryption encrypts data with a data encryption key, or DEK. Another key, the key encryption key or KEK, encrypts that DEK. This second operation is also called wrapping. The encrypted DEK can be stored alongside the encrypted data; the KEK is protected separately.
A fictional document portal encrypts file document-42 with a DEK generated for it. It has that DEK wrapped by a KEK in its key management service. Alongside the document, it stores the encrypted file, wrapped DEK and required key reference. It does not persist the unencrypted DEK there.
Account for both layers when reading
To open the file, the application needs access to the encrypted file and wrapped DEK. With appropriate permission at the key management service, it can unwrap the DEK and use it to decrypt the file. Key-use permissions and handling of the DEK available in memory therefore remain security concerns.
A stolen data copy with its wrapped DEK is not the same as access to the protective KEK. However, if an attacker also gains sufficient unwrapping permissions, this separation can lose its protective effect. The construction therefore does not replace access control. A later KEK rotation must also establish which wrapped keys and older versions are still needed.
Sources
Related terms
- Key rotationKey rotation introduces new key material. Older data and backups need a plan for the key versions they still require for decryption.
- Audit logAn audit log makes important application events traceable. Actor, action, affected object and outcome need to be readable together.
- Data retention policyA data retention policy defines the purpose, start, duration and end of storage. Deletion jobs and copies must be addressed in the implementation.
- Data minimisationData minimisation limits personal data to what is adequate, relevant and necessary for a defined purpose.
- Password saltingPassword salting gives each new password hash its own random additional value. The salt is stored alongside it and does not need to be secret.
- Argon2Argon2 is a family of memory-intensive password hash functions. The variant, memory use and runtime must suit security and operational requirements.
Your project with ASES
Describe your project to us. We will get back to you with an initial assessment.