Symmetric encryption
Use envelope encryption
Encrypt data with a data key and protect that key with a separate key-encryption service so rotation and access can be controlled centrally.
8 minute lesson
Encrypting every record directly with one long-lived master key makes rotation and access harder. Envelope encryption separates roles.
Generate a data-encryption key, encrypt the data, then encrypt or wrap that key with a key-encryption key held by a managed KMS or vault. Store the wrapped data key with the ciphertext. Rotating the wrapping key may avoid re-encrypting all data.
One long-lived master key directly encrypts millions of records. Rotating it requires reading and rewriting every record while the old key remains broadly available.
Envelope encryption gives each object or group a data key and wraps that key with a centrally controlled key-encryption key. Rewrapping can rotate central protection without exposing or re-encrypting the bulk plaintext.
Draw and save one encrypted record containing ciphertext, nonce, wrapped data key, key identifier, version, and authenticated context. Simulate rotating the wrapping key by rewrapping the data key and prove the ciphertext bytes stay unchanged. Then use the wrong record context and capture the expected decryption failure.
Lesson completed